Unauthorized Passkey Addition in miniOrange 2FA WordPress Plugin

Executive Summary

This vulnerability affects the miniOrange 2FA WordPress plugin versions 6.2.9 to 6.3.0. It allows an attacker who knows a user's password to bypass second-factor authentication by registering an additional passkey on an account that already has one configured. The plugin fails to prevent pending passkey logins from adding extra authenticators.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the miniOrange 2FA WordPress plugin. If it is between 6.2.9 and 6.3.0, the system is vulnerable. Look for unauthorized passkey registrations or unusual authenticator additions on user accounts.

Useful 0 Not Useful 0

Impact Analysis

An attacker with knowledge of a user's password could bypass the second-factor authentication, gaining unauthorized access to the account. This could lead to data breaches, unauthorized actions, or further compromise of the WordPress site.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. It undermines authentication security, potentially resulting in non-compliance and associated penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the miniOrange 2FA plugin to version 6.3.1 or later immediately. Review user accounts for unauthorized passkey additions and remove any suspicious authenticators. Ensure strong password policies are enforced.

Useful 0 Not Useful 0