CVE-2026-106610
CriticalCVSS 9.8Summary
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation. This issue affects miniorange otp verification: from n/a through 5.5.7.
Risk Assessment
An attacker can escalate their privileges, gaining access to functions or data reserved for higher roles, potentially leading to full WordPress site takeover.
Recommendation
Update the miniOrange OTP Verification plugin to a version later than 5.5.7 and review user roles and permissions in the system.
Other vulnerabilities in miniOrange OTP Verification
See all- CVE-2026-61967Critical
Unauthenticated Privilege Escalation vulnerability in miniorange otp verification versions up to 5.5.1. An attacker can gain higher privileges without authentication.
- CVE-2026-42731Critical
CVE-2026-42731 describes an incorrect privilege assignment vulnerability in miniOrange OTP Verification that allows privilege escalation. This issue affects versions from n/a through 5.4.9 inclusive.
- CVE-2026-61957High
XSS vulnerability in miniorange otp verification up to version 5.5.1. An unauthenticated attacker can inject malicious JavaScript.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS