Executive brief
The miniOrange 2FA WordPress plugin is used to add two-factor authentication to WordPress sites. A low-privileged user can send one-time passcode emails to any email address they choose and repeatedly exhaust the site's OTP sending budget, preventing legitimate users from completing their login attempts and locking them out of the site.
Technical details
The plugin fails to restrict access to its OTP configuration send endpoint (mo2f_send_otp_for_configuration AJAX action) and does not bind the OTP recipient address to the authenticating user's registered email. A low-privileged user (Subscriber role) can harvest the nonce from a failed second-factor challenge and replay it with arbitrary email addresses and session identifiers. This allows the attacker to send OTP emails to attacker-controlled addresses without authentication and to drain the site's metered OTP credit pool through repeated requests. The vulnerability is a broken access control issue (CWE-862) that causes denial of service to legitimate users by depleting the OTP allowance, preventing them from receiving second-factor codes.
Affected products
- miniOrange 2FA before 6.2.7
Timeline
- 2026-07-27: disclosed: Publicly disclosed on WPScan
- 2026-06-27: patched: Fixed in version 6.2.7