The vulnerability allows an attacker to supply a forged one‑time password that the plugin verifies against an attacker‑supplied secret instead of the victim’s stored secret; this logic flaw permits an unauthenticated attacker who knows a victim’s login password to bypass two‑factor authentication and gain full access to the victim’s account, including administrative accounts. The weakness is an improper validation of an authentication token, weak cryptographic key management, and insufficient authentication controls.

All installations of the miniOrange 2FA WordPress plugin with a version prior to 6.2.6 are affected. The issue exists wherever the plugin is deployed on WordPress sites and where administrators rely on the plugin for two‑factor protection.

The vulnerability is exploitable by any unauthenticated user who learns a victim’s login password; no special privileges or software are required. The CVSS score of 8.1 indicates high severity. The EPSS score of < 1% suggests a low probability of exploitation, yet the availability of a simple bypass makes it feasible for an attacker. It is not listed in the CISA KEV catalog, but the potential for abuse remains significant for sites using this plugin for two‑factor authentication.