CVE-2026-61967
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Unauthenticated Privilege Escalation vulnerability in miniorange otp verification versions up to 5.5.1. An attacker can gain higher privileges without authentication.
Risk Assessment
Risk includes takeover of administrator accounts or other privileged roles, potentially leading to full system compromise.
Recommendation
Update the plugin to the latest patched version. Implement additional authentication mechanisms and restrict access to the admin panel.
Other vulnerabilities in miniorange otp verification
See all- CVE-2026-42731Critical
CVE-2026-42731 describes an incorrect privilege assignment vulnerability in miniOrange OTP Verification that allows privilege escalation. This issue affects versions from n/a through 5.4.9 inclusive.
- CVE-2026-61957High
XSS vulnerability in miniorange otp verification up to version 5.5.1. An unauthenticated attacker can inject malicious JavaScript.
Original NVD description (English source)
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS