CVE-2026-85984
Received Received - Intake

Authentication Bypass in miniOrange OTP Login WordPress Plugin

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: Wordfence

Description
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-85984
EUVD
EUVD-2026-87786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miniorange otp_login_verification_and_sms_notifications to 5.5.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The miniOrange OTP Login plugin for WordPress has an authentication bypass flaw. Unauthenticated attackers can log in as any administrator by submitting a specific POST parameter (mo_wp_login_intent=otp) with a known username and empty password. This bypasses password and OTP verification due to a missing guard in the plugin's code.

Impact Analysis

Attackers could gain full administrative access to a WordPress site without needing a password or OTP. This allows them to take control of the site, steal data, install malware, or deface content. The impact is severe as it affects sites using vulnerable plugin versions with specific settings enabled.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Immediately update the miniOrange OTP Login plugin to the latest version beyond 5.5.5 to patch the authentication bypass flaw. Disable the WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass options if enabled. Review user accounts for unauthorized access and reset administrator passwords as a precaution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85984. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart