The miniOrange 2FA WordPress plugin versions prior to 6.3.1 allows an attacker who knows a user’s password to register an additional passkey on an account that already has a passkey configured. This missing validation permits the attacker to add a passkey and subsequently bypass the second‑factor requirement, effectively compromising the two‑factor authentication flow.

Vendor and product: miniOrange 2FA Plugin for WordPress. Affected versions are any installation of miniOrange 2FA before version 6.3.1, including the 6.2.9 to 6.3.0 range.

Without proper verification, a remote attacker who can authenticate with the user’s password can add a rogue passkey and bypass the second factor, gaining unauthorized access. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation yet. The CVSS score is not provided in the data, so the precise severity cannot be quantified, but the attack path relies on remote web access to the WordPress site and knowledge of user credentials.