CVE-2026-16619
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
Risk Assessment
An attacker can take over a user's account knowing only the password, leading to account and data compromise.
Recommendation
Update the plugin to version 6.2.8 or later. Implement additional server-side rate limiting mechanisms.
Other vulnerabilities in miniOrange 2FA WordPress plugin
Original NVD description (English source)
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.