The vulnerability in the miniOrange 2FA WordPress plugin allows an attacker who has already compromised a user’s password to bypass the second‑factor authentication by repeatedly guessing the one‑time code without restriction. Because the plugin incorrectly tracks verification attempts using a client‑supplied identifier that is reset on each login, the limit is never enforced. An attacker who can generate or obtain a valid code could ultimately log in, gaining full access to the account’s data and any associated administrative capabilities. The weakness is a failure to enforce authentication bounds and can be classified under CWE‑703.

This flaw affects the miniOrange 2FA plugin for WordPress versions prior to 6.2.8. All installations of the plugin that have not been upgraded to version 6.2.8 or later are vulnerable. The plugin is commonly used on sites that rely on secondary authentication for site administrators and other privileged users.

The CVSS score of 7.5 indicates a high severity, reflecting the potential for complete account takeover. The EPSS score is not available, so the exploitation probability cannot be quantified, but given the lack of a countermeasure and the public knowledge of the bug, the likelihood of exploitation remains significant. The vulnerability is not listed in the CISA KEV catalog, but attackers can craft simple brute‑force scripts to exploit the unlimited attempt flaw. The attack path involves obtaining a user’s password through phishing or credential dumping, logging in, and then repeatedly requesting the one‑time code until the correct value is discovered.