Executive brief
The miniOrange 2FA WordPress plugin enforces one-time passcode (OTP) rate limits based on a client-supplied identifier rather than the actual user account, and a second validation endpoint has no rate limiting at all. An attacker with a victim's password can bypass two-factor authentication by making unlimited OTP guesses, fully defeating the security layer intended to prevent unauthorized account access.
Technical details
The vulnerability is an authentication bypass (CWE-287) in the OTP validation logic. The plugin keys its second-factor attempt limit to a client-controllable identifier instead of the target account, allowing an attacker to change the identifier at will and reset the attempt counter. Additionally, a second validation endpoint applies no rate limiting whatsoever. The attack requires prior knowledge of the victim's password but needs no authentication or user interaction beyond submitting OTP guesses. An attacker can perform a brute-force attack against the OTP space to compromise any account protected by this plugin's 2FA. Patches are available in versions 6.3.1 and 19.3.
Affected products
- miniOrange 2FA before 6.3.1, before 19.3
Timeline
- 2026-09-08: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Versions 6.3.1 and 19.3 available