Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: miniOrange 2FA, miniOrange 2FA 19.3, 6.3.1 Clear all filters
TI-2026-54164 CVE-2026-77771 · GHSA-fg24-3rh9-37gf

miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

Priority LOW 35

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client su…

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00323 Published 2026-09-10 Fixed in 6.3.1, 19.3 CWE-287
TI-2026-54163 CVE-2026-77770 · GHSA-vfpr-3q2h-v432

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

Priority MEDIUM 49

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, all…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00437 Published 2026-09-10 Fixed in 6.3.1, 19.3 CWE-862