The vulnerability is an Incorrect Privilege Assignment flaw that allows an attacker to gain higher privileges within the WordPress installation. Exploitation can enable an unauthorized user to perform administrative actions they normally cannot, potentially leading to full site compromise. The weakness is classified as CWE-266, indicating inadequate protection of permissions.

The issue affects the WordPress miniOrange OTP Verification plugin, any version from unknown baseline up to and including 5.5.7. Administrators running any of these versions should verify the installed version and consider updating.

The CVSS score of 9.8 marks this as Critical. EPSS data is unavailable, so the likelihood of exploitation cannot be quantified, but the lack of a KEV listing suggests no publicly known exploit yet. The most likely attack vector is through the plugin’s settings or the user management interface, which can be accessed by authenticated users who exploit the privilege escalation path. Once the flaw is triggered, an attacker can elevate their effective permissions to administrator or higher.