The miniOrange OTP Verification plugin contains an incorrect privilege assignment flaw that permits an attacker to elevate their own user role within a WordPress site. This vulnerability, classified as CWE-266, allows a lower‑privileged account to acquire higher permissions, effectively compromising the site’s administrative controls.

WordPress installations using the miniOrange OTP Verification plugin version 5.4.9 or earlier are affected. Any site that has not upgraded beyond this version remains vulnerable.

The CVSS score of 9.8 signals a critical severity. EPSS data is currently unavailable, and the issue is not listed in the CISA KEV catalog, indicating no widespread exploits have been reported. The likely attack vector involves HTTP requests to plugin endpoints, potentially requiring an authenticated session to trigger the privilege escalation. Once the flaw is triggered, an attacker can gain full administrative capabilities.