Authentication Bypass in miniOrange 2FA Plugin for WordPress
CVE-2026-77771
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-77771?
The miniOrange 2FA plugin for WordPress prior to version 6.3.1 and 19.3 allows an attacker with knowledge of a victim's password to bypass authentication limits. This occurs because the plugin does not properly associate second-factor authentication attempt limits with user accounts, enabling unlimited guesses for one-time passcodes. Additionally, another validation endpoint lacks any attempt restrictions, further compounding the risk of unauthorized access.
Affected Version(s)
miniOrange 2FA 6.2.8 < 6.3.1
miniOrange 2FA 18.0 < 19.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.