CVE-2026-77770

Name of the Vulnerable Software and Affected Versions miniOrange 2FA WordPress plugin versions prior to 6.3.1 miniOrange 2FA WordPress plugin versions prior to 19.3

Description An issue exists where the software does not require a validated transaction before deleting site options. This allows unauthenticated visitors to delete arbitrary options by providing the option names via request input, which can result in administrators being locked out of the dashboard or the plugin being deactivated on the site.

Recommendations Update miniOrange 2FA WordPress plugin to version 6.3.1 or later. Update miniOrange 2FA WordPress plugin to version 19.3 or later.