CVE-2026-12695

Name of the Vulnerable Software and Affected Versions miniOrange 2FA WordPress plugin versions prior to 6.2.6

Description The plugin fails to validate the submitted one-time password against the stored secret of the targeted user. Instead, it verifies the password against a value supplied by the attacker. This allows an unauthenticated attacker who possesses a victim's password to bypass two-factor authentication and gain unauthorized access to the account, including those with administrator privileges.

Recommendations Update the miniOrange 2FA WordPress plugin to version 6.2.6 or later.