Executive brief
The miniOrange OTP Login plugin for WordPress, used to secure user logins with one-time passwords, contains an authentication bypass flaw. An unauthenticated attacker can log in as any administrator account by submitting a username alone—without providing a password or OTP code—if the site has specific plugin settings enabled. This allows immediate account takeover and full administrative access to the WordPress site.
Technical details
The mo_by_pass_login() function fails to validate the mo_wp_login_intent parameter when skip_pass_fallback is enabled, treating administrator role membership as sufficient authentication without password verification. An attacker can send an unauthenticated POST request with mo_wp_login_intent=otp and a known username, causing mo_get_user() to bypass wp_authenticate_username_password() and authenticate as an admin. Exploitation requires the site administrator to simultaneously enable WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass settings.
Affected products
- miniOrange OTP Login, Verification and SMS Notifications up to and including 5.5.5
Timeline
- 2026-09-26: disclosed