CVE-2026-16036

Name of the Vulnerable Software and Affected Versions miniOrange 2FA WordPress plugin versions prior to 6.2.7

Description The plugin fails to bind the second factor configured during the pre-login two-factor challenge to the existing factor of the target account. This allows an attacker who possesses a user's password to rebind the second factor to a destination they control, successfully complete the challenge, and take over the account, including those with administrator privileges.

Recommendations Update the miniOrange 2FA WordPress plugin to version 6.2.7 or later.