CVE-2026-77770
Deferred Deferred - Pending Action

Authentication Bypass in miniOrange 2FA WordPress Plugin

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: WPScan

Description
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-77770
EUVD
EUVD-2026-75263

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
miniorange 2fa_wordpress_plugin to 6.3.1 (exc)
miniorange 2fa_wordpress_plugin to 19.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the miniOrange 2FA WordPress plugin versions before 6.3.1 (Free) and 19.3 (Pro). It allows unauthenticated attackers to delete arbitrary site options by exploiting a flaw in the email link validator. This can lock administrators out of the dashboard or deactivate all plugins on the site.

Detection Guidance

Check the installed version of the miniOrange 2FA WordPress plugin. If it is below 6.3.1 (Free) or 19.3 (Pro), the system is vulnerable. Logs may show unauthorized deletion of site options or plugin deactivations.

Impact Analysis

An attacker could exploit this to delete critical site options, causing loss of access to the WordPress dashboard or disabling all miniOrange 2FA plugins. This would disrupt site administration and authentication functionality entirely.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized access to administrative functions, potentially exposing sensitive user data or system configurations. Unauthenticated attackers could delete critical site options, disrupting security controls or logging mechanisms required for compliance.

Mitigation Strategies

Update the miniOrange 2FA plugin to version 6.3.1 (Free) or 19.3 (Pro) immediately. If already exploited, restore deleted options from backups and verify plugin functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77770. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart