miniOrange OTP plugin for WordPress: Authentication bypass via Delay OTP
Summary
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress, up to and including 5.5.8, contains an authentication bypass. If a site uses OTP-only login together with Delay OTP Verification, an unauthenticated attacker who knows a username can log in as that user, including administrators, without a valid password. The attack only works while the target account is within its Delay OTP interval.
Affected
- miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress, all versions up to and including 5.5.8
- Exploitation requires OTP-only login (wp_login_skip_password=1, wp_login_skip_password_fallback=0) and Delay OTP Verification (wp_login_delay_otp=1)
Fixed in
Unknown. No confirmed fixed version was found. Version 5.5.8 is not a fix. Check the Wordfence advisory and the WordPress.org changelog before updating.
Workaround
- Disable Delay OTP Verification if it is not strictly necessary. The 5.5.8 changelog calls this setting "Skip OTP on repeat logins".
- Disable OTP-only login if it is not required. This removes the precondition.
Exploitation
- Exploited in the wild: not confirmed. A GitHub tracker lists the CVE as not in CISA KEV. A VulnCheck KEV record appears only in aggregator mirrors and could not be verified.
- Public proof of concept: none found for this CVE. A public PoC targets the related earlier CVE-2026-85984.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Inventory WordPress sites with this plugin and record the installed version.
- Check whether OTP-only login or Delay OTP Verification is enabled. If so, disable Delay OTP now and consider disabling OTP-only login.
- Update to a fixed version once the Wordfence advisory confirms it.
- Restrict access to wp-login.php where feasible.
- Review logs for administrator logins without a password prompt and check for unexpected admin sessions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence advisory www.wordfence.com
- Wordfence advisory mirror (threatint) cve.threatint.com
- VulDB CVE-2026-103895 vuldb.com
- WordPress.org plugin page wordpress.org
- Patchstack vulnerability list patchstack.com
- Trac changeset 3733803 plugins.trac.wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:56.
Original description (NVD)
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
NVD references (8)
- https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wplogin…
- https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wplogin…
- https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wplogin…
- https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wplogin…
- https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wplogin…
- https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261
- https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wp…
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.