The miniOrange OTP Login, Verification and SMS Notifications plugin contains a missing password‑intent guard in the skip_pass_fallback branch of the mo_by_pass_login() function, allowing unauthenticated attackers to send a POST request with mo_wp_login_intent=otp, an empty password, and a target username. This causes the plugin to skip the standard WordPress authentication routine and resolve a user purely from a username lookup, effectively authenticating the attacker as that user without a password or OTP. The flaw is limited to sites where the administrator has enabled WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass. The resulting authentication bypass gives the attacker full administrative privileges, compromising confidentiality, integrity, and availability of the entire WordPress site.

The vulnerability affects the WordPress plugin miniOrange OTP Login, Verification and SMS Notifications version 5.5.5 and all earlier releases. The plugin is distributed by the vendor cyberlord92. Any WordPress installation running a vulnerable version with the four configuration options listed above enabled is exposed. The scope is local to the affected site; attackers cannot bypass other site instances without control of the same CMS installation.

The CVSS score of 9.8 classifies this a critical vulnerability. The EPSS score is not available, but the exploit requires only a known username and crafting a simple HTTP POST, so the likelihood of exploitation is high. The vulnerability is not yet listed in CISA’s KEV catalog. The attack can be performed remotely by anyone with Internet access who can reach the site’s login endpoint. Successful exploitation would give the attacker complete control over the site, allowing them to modify content, install malicious plugins, or exfiltrate data.