Read the docs
TI-2026-54163 Aliases CVE-2026-77770GHSA-vfpr-3q2h-v432

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

Priority MEDIUM 49CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed miniOrange 2FA (Unknown): 6.3.1, 19.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownminiOrange 2FA5.3.24 to before 6.3.16.3.1Patch availableCNA
UnknownminiOrange 2FA18.0 to before 19.319.3Patch availableCNA
  • miniOrange 2FA VendorUnknown Affected 5.3.24 to before 6.3.1 Fixed in 6.3.1 Patch available CNA
  • miniOrange 2FA VendorUnknown Affected 18.0 to before 19.3 Fixed in 19.3 Patch available CNA

Remediation

  • Fix · CNA miniOrange 2FA (Unknown) Fixed in 6.3.1
  • Fix · CNA miniOrange 2FA (Unknown) Fixed in 19.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    miniOrange 2FA 19.3, 6.3.1

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-54164 miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP LockoutPriority LOW 35
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77770
  2. 2026-10-03 Alias added: GHSA-vfpr-3q2h-v432

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences