CVE-2026-16035

MediumCVSS 4.3

Published: 04/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

The miniOrange 2FA WordPress plugin before version 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

Risk Assessment

Exhausting the OTP allowance can prevent legitimate users from logging in, and sending OTPs to arbitrary recipients can be used for phishing or spam.

Recommendation

Update the miniOrange 2FA plugin to version 6.2.7 or later. Restrict access to 2FA configuration functions and monitor OTP sending.

Other vulnerabilities in miniOrange 2FA

CVE-2026-12695High
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

Original NVD description (English source)

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.