miniOrange's Google Authenticator < 5.5 - Unauthenticated Arbitrary Options Deletion
Priority LOW 36CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
Why it matters now
EPSS 0.00549 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed miniOrange's Google Authenticator (Unknown): 5.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | miniOrange's Google Authenticator | before 5.5 | 5.5 | Patch available | CNA |
- miniOrange's Google Authenticator VendorUnknown Affected before 5.5 Fixed in 5.5 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:miniorange:google_authenticator:*:*:*:*:*:wordpress:*:* | before 5.5 | Vulnerable | miniOrange |
- cpe:2.3:a:miniorange:google_authenticator:*:*:*:*:*:wordpress:*:* Versions before 5.5 Vulnerable ·miniOrange
Remediation
- Fix · CNA miniOrange's Google Authenticator (Unknown) Fixed in 5.5
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0229
- 2026-10-03 Alias added: GHSA-93c5-xvhq-3947
References
More miniOrange Google Authenticator vulnerabilities
- TI-2022-04534 miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change CVSS 3.1HIGH 7.5
- TI-2022-20660 WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2022-21926 WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure CVSS 3.1HIGH 8.1
- TI-2022-01203 miniOrange's Google Authenticator < 5.5.6 - Admin+ Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.8
- TI-2022-00780 miniOrange Google Authenticator < 1.0.5 - CSRF to Stored Cross-Site Scripting CVSS 3.1MEDIUM 4.3
Sources
- CVE-2022-0229 · CVE Program
- CVE-2022-0229 · NVD
- FIRST EPSS
- GHSA-93c5-xvhq-3947 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences