The miniOrange 2FA WordPress plugin versions prior to 6.3.1 allows an attacker who knows a user’s password to register an additional passkey on an account that already has a passkey configured. This missing validation permits the attacker to add a passkey and subsequently bypass the second‑factor requirement, effectively compromising the two‑factor authentication flow.

Vendor and product: miniOrange 2FA Plugin for WordPress. Affected versions are any installation of miniOrange 2FA before version 6.3.1, including the 6.2.9 to 6.3.0 range.

Without proper verification, a remote attacker who can authenticate with the user’s password can add a rogue passkey and bypass the second factor, gaining unauthorized access. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. The CVSS score is 7.5, indicating a high severity vulnerability. The attack path relies on remote web access to the WordPress site and knowledge of user credentials.