PT-2026-67654 · WordPress · Miniorange 2Fa
CVE-2026-16035
·
Published
2026-08-04
·
Updated
2026-08-04
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
miniOrange 2FA versions prior to 6.2.7
Description
The plugin fails to restrict who can trigger the second-factor configuration OTP send and does not bind the OTP recipient to the enrolling user's own address. This allows a low-privileged user to send one-time-passcode emails to arbitrary recipients, which can lead to the exhaustion of the site's metered OTP allowance and prevent legitimate users from receiving their codes.
Recommendations
Update to version 6.2.7 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Miniorange 2Fa