Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-11
Miniorange Otp Verification - Security Vulnerability (CVE-2026-106610)
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
PLUGIN
Miniorange Otp Verification
CVE-2026-106610
Risk Score
Threat Entry
Updated 2026-09-28
Miniorange Otp Verification - Security Vulnerability (CVE-2026-85984)
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log…
PLUGIN
Miniorange Otp Verification
CVE-2026-85984
Risk Score
Threat Entry
Updated 2026-10-23
miniorange otp verification - Privilege Escalation (CVE-2026-61967)
Unauthenticated Privilege Escalation in miniorange otp verification
PLUGIN
miniorange otp verification
CVE-2026-61967
Risk Score
Threat Entry
Updated 2026-07-28
miniorange otp verification - Cross-Site Scripting (XSS) (CVE-2026-61957)
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification
PLUGIN
miniorange otp verification
CVE-2026-61957
Risk Score
Threat Entry
Updated 2026-07-09
Miniorange Otp Verification - Authentication Bypass (CVE-2026-14245)
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction…
PLUGIN
Miniorange Otp Verification
CVE-2026-14245
Risk Score
Threat Entry
Updated 2026-06-17
Miniorange Otp Verification - Privilege Escalation (CVE-2026-42731)
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through
PLUGIN
Miniorange Otp Verification
CVE-2026-42731
Risk Score
Threat Entry
Updated 2026-06-17
Miniorange Otp Verification - Broken Access Control (CVE-2023-47776)
Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through
PLUGIN
Miniorange Otp Verification
CVE-2023-47776
Risk Score