Vulnerabilities / miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) / WPSEC-2026-2234
miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.5.0 - Authentication Bypass via Google Authenticator Code Replay
Medium 4.8
CWE-294Fixed in 6.6.0
- ID
- WPSEC-2026-2234
- Plugin
- miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) (miniorange-2-factor-authentication)
- Affected
- all versions before 6.6.0
- Remediation
- Update to 6.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-294
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) on WPSec AttackSurface
- Fix released
- Published
Description
The miniOrange 2FA plugin for WordPress is vulnerable to an authentication bypass via replay of Google Authenticator (TOTP) codes in all versions up to, and including, 6.5.0. This is due to the on-premise Google Authenticator verification not recording successfully accepted codes as used, so the existing 'already used' check never triggers. This makes it possible for unauthenticated attackers who already know a user's password and have captured or observed a valid one-time code to reuse that code within its acceptance window, defeating the one-time property of the second factor.
References
- https://wpsec.com/vuln/WPSEC-2026-2234/
- https://plugins.svn.wordpress.org/miniorange-2-factor-authentication/tags/6.6.0/
- https://wordpress.org/plugins/miniorange-2-factor-authentication/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS