# CVE-2026-85984: miniOrange OTP Login Verification and SMS Notifications authentication bypass

Source: https://junglewise.ai/threats/cve-2026-85984-the-miniorange-otp-login-verification-and-sms-notifications  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85984 · Severity: critical · CVSS 9.8 · Published 2026-09-26

The miniOrange OTP Login plugin for WordPress, used to secure user logins with one-time passwords, contains an authentication bypass flaw. An unauthenticated attacker can log in as any administrator account by submitting a username alone—without providing a password or OTP code—if the site has specific plugin settings enabled. This allows immediate account takeover and full administrative access to the WordPress site.

Technologies: [miniOrange OTP Login, Verification and SMS Notifications](https://junglewise.ai/threats/technologies/otp-login-verification-and-sms-notifications). Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-85984 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85984 being exploited in the wild.

**How severe is CVE-2026-85984?** Critical severity, with a CVSS score of 9.8, published 26 September 2026.

**Which products and versions are affected?** miniOrange OTP Login, Verification and SMS Notifications up to and including 5.5.5.

**Is there a fix for CVE-2026-85984?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85984 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-85984?** Check whether you run miniOrange OTP Login or Verification and SMS Notifications at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The mo_by_pass_login() function fails to validate the mo_wp_login_intent parameter when skip_pass_fallback is enabled, treating administrator role membership as sufficient authentication without password verification. An attacker can send an unauthenticated POST request with mo_wp_login_intent=otp and a known username, causing mo_get_user() to bypass wp_authenticate_username_password() and authenticate as an admin. Exploitation requires the site administrator to simultaneously enable WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass settings.

## Affected products

- miniOrange OTP Login, Verification and SMS Notifications up to and including 5.5.5

## Timeline

- 2026-09-26: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/includes/js/loginform.js](https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/includes/js/loginform.js)
- [https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/views/forms/mowploginform.php](https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/views/forms/mowploginform.php)

## Related threats

- [miniOrange OTP Login authentication bypass via Delay OTP](https://junglewise.ai/threats/cve-2026-103895-the-miniorange-otp-login-verification-and-sms-notifications)
- [miniOrange OTP Login authentication bypass in Ultimate Member reset hook](https://junglewise.ai/threats/cve-2026-14245-miniorange-otp-login-authentication-bypass-in-ultimate-member)