Quick answers
- Is CVE-2026-12695 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12695 being exploited in the wild.
- How severe is CVE-2026-12695?
- Informational severity, with a CVSS score of 8.1, published 31 July 2026.
- Which products and versions are affected?
- miniOrange 2FA < 6.2.6.
- Is there a fix for CVE-2026-12695?
- A patch was published on 2026-07-15: Fixed in version 6.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-12695 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12695?
- Check whether you run miniOrange 2FA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication bypass vulnerability exists in the miniOrange 2FA plugin for WordPress (versions prior to 6.2.6) due to improper validation of the Google Authenticator secret (ga_secret). The plugin fails to verify the submitted one-time password (OTP) against the secret key stored in the victim's user profile. Instead, the validation logic utilizes an attacker-controlled value provided during the authentication request. An unauthenticated attacker with knowledge of a victim's primary password can exploit this by providing their own secret and a corresponding valid OTP to bypass the 2FA requirement. This allows full access to the victim's account, including administrative accounts. The issue is resolved in version 6.2.6.
Affected products
- miniOrange miniOrange 2FA < 6.2.6
Timeline
- 2026-07-15: disclosed
- 2026-07-15: patched: Fixed in version 6.2.6
- 2026-07-31: advisory