# CVE-2026-12695: miniOrange 2FA WordPress plugin authentication bypass via ga_secret

Source: https://junglewise.ai/threats/cve-2026-12695-miniorange-2fa-wordpress-plugin-authentication-bypass-via-ga  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-12695 · Severity: info · CVSS 8.1 · Published 2026-07-31

A vulnerability in the miniOrange 2FA plugin for WordPress allows attackers to bypass two-factor authentication. This plugin is used to add an extra layer of security to user logins; however, this flaw allows an attacker who already knows a user's password to log in without providing a valid security code. This could lead to unauthorized access to sensitive accounts, including those with administrative privileges, potentially resulting in a full site takeover.

Technologies: [miniOrange 2FA](https://junglewise.ai/threats/technologies/2fa). Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-12695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12695 being exploited in the wild.

**How severe is CVE-2026-12695?** Informational severity, with a CVSS score of 8.1, published 31 July 2026.

**Which products and versions are affected?** miniOrange 2FA < 6.2.6.

**Is there a fix for CVE-2026-12695?** A patch was published on 2026-07-15: Fixed in version 6.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12695 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12695?** Check whether you run miniOrange 2FA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authentication bypass vulnerability exists in the miniOrange 2FA plugin for WordPress (versions prior to 6.2.6) due to improper validation of the Google Authenticator secret (ga_secret). The plugin fails to verify the submitted one-time password (OTP) against the secret key stored in the victim's user profile. Instead, the validation logic utilizes an attacker-controlled value provided during the authentication request. An unauthenticated attacker with knowledge of a victim's primary password can exploit this by providing their own secret and a corresponding valid OTP to bypass the 2FA requirement. This allows full access to the victim's account, including administrative accounts. The issue is resolved in version 6.2.6.

## Affected products

- miniOrange miniOrange 2FA < 6.2.6

## Timeline

- 2026-07-15: disclosed
- 2026-07-15: patched: Fixed in version 6.2.6
- 2026-07-31: advisory

## References

- [https://wpscan.com/vulnerability/1994ce51-3534-4cb3-b424-d2f9014e8bb3/](https://wpscan.com/vulnerability/1994ce51-3534-4cb3-b424-d2f9014e8bb3/)

## Related threats

- [miniOrange 2FA authentication bypass via passkey rebinding](https://junglewise.ai/threats/cve-2026-111949-the-miniorange-2fa-wordpress-plugin-before-6-3-1-does-not)
- [miniOrange 2FA 2FA bypass via unscoped attempt limit](https://junglewise.ai/threats/cve-2026-77771-miniorange-2fa-2fa-bypass-via-unscoped-attempt-limit)
- [miniOrange 2FA missing authorization in option deletion](https://junglewise.ai/threats/cve-2026-77770-miniorange-2fa-missing-authorization-in-option-deletion)
- [miniOrange 2FA arbitrary-recipient OTP send in WordPress plugin](https://junglewise.ai/threats/cve-2026-16035-miniorange-2fa-arbitrary-recipient-otp-send-in-wordpress-plugin)