Description
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
Published: 2026-10-16
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress contains an authentication bypass flaw that allows an unauthenticated attacker to authenticate as any user, including administrators, without knowing the correct password.

Affected Systems

WordPress sites running the miniOrange OTP plugin version 5.5.8 or earlier, released by cyberlord92, are affected.

Risk and Exploitability

The CVSS score of 8.1 indicates a high severity vulnerability; the EPSS score is not available, so the exact likelihood of exploitation is unknown but the attack can be realized by sending a login request with the mo_wp_login_intent=otp parameter and any non‑empty password. The flaw is not yet listed in the CISA KEV catalog. An attacker must enable OTP‑only login and the Delay OTP verification option; once those settings are active the bypass can be triggered remotely via standard HTTP requests to the WordPress login endpoint, allowing the attacker to assume the privileges of the targeted account.

Generated by OpenCVE AI on October 16, 2026 at 13:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the miniOrange OTP plugin to the latest version that includes the fix (5.5.9 or later).
  • Until the patch is applied, disable OTP‑only login and Delay OTP verification in the plugin settings to eliminate the bypass path.
  • Monitor login logs for suspicious activity and review any recent changes to user privileges.

Generated by OpenCVE AI on October 16, 2026 at 13:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Cyberlord92
Cyberlord92 miniorange Otp Login, Verification And Sms Notifications
Wordpress-extensions
Wordpress-extensions miniorange Otp Login, Verification And Sms Notifications
Vendors & Products Cyberlord92
Cyberlord92 miniorange Otp Login, Verification And Sms Notifications
Wordpress-extensions
Wordpress-extensions miniorange Otp Login, Verification And Sms Notifications

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 04:45:00 +0000

Type Values Removed Values Added
Description The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
Title miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Cyberlord92 Miniorange Otp Login, Verification And Sms Notifications
Wordpress-extensions Miniorange Otp Login, Verification And Sms Notifications
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-16T15:45:41.000Z

Reserved: 2026-10-01T13:48:24.914Z

Link: CVE-2026-103895

cve-icon Vulnrichment

Updated: 2026-10-16T15:45:36.025Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T05:17:28.333

Modified: 2026-10-16T16:16:54.177

Link: CVE-2026-103895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T07:45:04Z

Weaknesses