Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-77770: miniOrange 2FA plugin lets anyone delete settings
CVE-2026-77770 · published 1 month ago
Summary
The miniOrange two‑factor authentication plugin for WordPress can be tricked by anyone on the web to remove its own configuration data. Removing these settings can lock administrators out of the dashboard or turn off two‑factor protection entirely. Update the plugin to the latest version or apply the vendor’s fix as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | miniorange 2fa |
< 6.3.1 < 19.3 |
Original advisory text
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
10.0
Critical
Type
CWE-862Missing Authorization
Timeline
Published10 Sep 2026
Updated11 Oct 2026
First seen10 Sep 2026
Track software like this
Free during beta