CVE-2026-16619

Name of the Vulnerable Software and Affected Versions miniOrange 2FA WordPress plugin versions prior to 6.2.8

Description The plugin fails to correctly limit the number of second-factor verification attempts. It tracks these attempts using a client-supplied identifier that is reissued during every login process. This flaw allows an attacker who has already obtained a user's password to perform a brute force attack on the one-time code without restrictions to take over the account.

Recommendations Update the plugin to version 6.2.8 or later.