{
 "id": "WPSEC-2026-2234",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2234/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2234/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2234/index.md",
 "title": "miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.5.0 - Authentication Bypass via Google Authenticator Code Replay",
 "description": "The miniOrange 2FA plugin for WordPress is vulnerable to an authentication bypass via replay of Google Authenticator (TOTP) codes in all versions up to, and including, 6.5.0. This is due to the on-premise Google Authenticator verification not recording successfully accepted codes as used, so the existing 'already used' check never triggers. This makes it possible for unauthenticated attackers who already know a user's password and have captured or observed a valid one-time code to reuse that code within its acceptance window, defeating the one-time property of the second factor.",
 "plugin": {
  "slug": "miniorange-2-factor-authentication",
  "name": "miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator)",
  "full_name": "miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)",
  "wordpress_org": "https://wordpress.org/plugins/miniorange-2-factor-authentication/",
  "advisories_url": "https://wpsec.com/vuln/plugin/miniorange-2-factor-authentication/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/miniorange-2-factor-authentication"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-294"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "6.6.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 6.6.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "6.6.0",
 "remediation": "Update to 6.6.0 or later.",
 "fix_released": "2026-11-02T03:39:12+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:20:49.324065+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2234/",
  "https://plugins.svn.wordpress.org/miniorange-2-factor-authentication/tags/6.6.0/",
  "https://wordpress.org/plugins/miniorange-2-factor-authentication/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/miniorange-2-factor-authentication",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}