Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

miniOrange OTP plugin lets attackers log in as admin

CVE-2026-85984 · published 1 day ago
Summary

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress can let someone sign in as an administrator without a password or one‑time code. This happens when several specific OTP options are turned on, allowing an attacker to submit a special request with a known username and gain full admin access. Turn off the OTP login features or update the plugin to a version that removes this behavior, and make sure only trusted administrators can change plugin settings.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
cyberlord92 miniorange otp login, verification and sms notifications <= 5.5.5
Original advisory text
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.
References
Severity
9.8 Critical
CVSS 3.1: 9.8 (MITRE)
Type
CWE-287Improper Authentication
Timeline
Published26 Sep 2026
Updated27 Sep 2026
First seen26 Sep 2026
Sources
CVE-2026-85984 · NVD
CVE-2026-85984 · MITRE
Track software like this
Free during beta