# miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) <= 6.5.0 - Authentication Bypass via Google Authenticator Code Replay

- **ID:** WPSEC-2026-2234
- **Plugin:** miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) (`miniorange-2-factor-authentication`), https://wordpress.org/plugins/miniorange-2-factor-authentication/
- **Affected versions:** all versions before 6.6.0
- **Fixed in:** 6.6.0 (Update to 6.6.0 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-294
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/miniorange-2-factor-authentication
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2234/

## Description

The miniOrange 2FA plugin for WordPress is vulnerable to an authentication bypass via replay of Google Authenticator (TOTP) codes in all versions up to, and including, 6.5.0. This is due to the on-premise Google Authenticator verification not recording successfully accepted codes as used, so the existing 'already used' check never triggers. This makes it possible for unauthenticated attackers who already know a user's password and have captured or observed a valid one-time code to reuse that code within its acceptance window, defeating the one-time property of the second factor.

## References

- https://wpsec.com/vuln/WPSEC-2026-2234/
- https://plugins.svn.wordpress.org/miniorange-2-factor-authentication/tags/6.6.0/
- https://wordpress.org/plugins/miniorange-2-factor-authentication/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2234/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.