Auth bypass in Miniorange 2fa
CVE-2026-77770
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
Vulnerability class: Broken Access Control
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H.
Affected products
- Unknown Miniorange 2fa
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-77770?
- CVE-2026-77770 is a critical-severity vulnerability in Miniorange 2fa, classified under Missing Authorization. CVSS score: 10.0/10. Published 2026-09-10.
- How severe is CVE-2026-77770?
- Critical severity. CVSS v3 base score is 10.0 out of 10.