The vulnerability allows an attacker who knows a victim's password to make unlimited one‑time passcode guesses because the plugin does not scope the second‑factor attempt limit to the attacked account. This bypasses two‑factor authentication, enabling full account compromise. The flaw stems from improper authentication controls, as the attempt counter is keyed to a client‑supplied identifier that an attacker can change at will, and a secondary validation endpoint applies no attempt limit.

WordPress installations with miniOrange 2FA plugin versions earlier than 6.3.1 or earlier than 19.3 are affected. The product is the miniOrange 2FA (Free & Pro) WordPress plugin.

The vulnerability is exploitable by legitimate users who already possess a user's password and can submit malicious passcode guesses through standard login flows. Attackers need only supply a client‑controlled identifier to reset the counter, so the second‑factor lockout can be evaded entirely. Although EPSS information is not available, the impact is significant because it removes the intended security layer, and the flaw is listed as a known vulnerability. The lack of a restrictor on the second validation endpoint means the flaw can be abused without any special network conditions.