# CVE-2026-16035: miniOrange 2FA arbitrary-recipient OTP send in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-16035-miniorange-2fa-arbitrary-recipient-otp-send-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16035 · Severity: medium · CVSS 4.3 · Published 2026-08-04

The miniOrange 2FA WordPress plugin is used to add two-factor authentication to WordPress sites. A low-privileged user can send one-time passcode emails to any email address they choose and repeatedly exhaust the site's OTP sending budget, preventing legitimate users from completing their login attempts and locking them out of the site.

Technologies: [miniOrange 2FA](https://junglewise.ai/threats/technologies/2fa). Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-16035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16035 being exploited in the wild.

**How severe is CVE-2026-16035?** Medium severity, with a CVSS score of 4.3, published 4 August 2026.

**Which products and versions are affected?** miniOrange 2FA before 6.2.7.

**Is there a fix for CVE-2026-16035?** A patch was published on 2026-06-27: Fixed in version 6.2.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16035 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-16035?** Check whether you run miniOrange 2FA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to restrict access to its OTP configuration send endpoint (mo2f_send_otp_for_configuration AJAX action) and does not bind the OTP recipient address to the authenticating user's registered email. A low-privileged user (Subscriber role) can harvest the nonce from a failed second-factor challenge and replay it with arbitrary email addresses and session identifiers. This allows the attacker to send OTP emails to attacker-controlled addresses without authentication and to drain the site's metered OTP credit pool through repeated requests. The vulnerability is a broken access control issue (CWE-862) that causes denial of service to legitimate users by depleting the OTP allowance, preventing them from receiving second-factor codes.

## Affected products

- miniOrange 2FA before 6.2.7

## Timeline

- 2026-07-27: disclosed: Publicly disclosed on WPScan
- 2026-06-27: patched: Fixed in version 6.2.7

## References

- [https://wpscan.com/vulnerability/26217efe-b867-4bb9-ac7c-765fb796e2c1/](https://wpscan.com/vulnerability/26217efe-b867-4bb9-ac7c-765fb796e2c1/)

## Related threats

- [miniOrange 2FA authentication bypass via passkey rebinding](https://junglewise.ai/threats/cve-2026-111949-the-miniorange-2fa-wordpress-plugin-before-6-3-1-does-not)
- [miniOrange 2FA 2FA bypass via unscoped attempt limit](https://junglewise.ai/threats/cve-2026-77771-miniorange-2fa-2fa-bypass-via-unscoped-attempt-limit)
- [miniOrange 2FA missing authorization in option deletion](https://junglewise.ai/threats/cve-2026-77770-miniorange-2fa-missing-authorization-in-option-deletion)
- [miniOrange 2FA WordPress plugin authentication bypass via ga_secret](https://junglewise.ai/threats/cve-2026-12695-miniorange-2fa-wordpress-plugin-authentication-bypass-via-ga)