miniOrange OTP Verification plugin: Privilege escalation and authentication bypass

Summary

The WordPress plugin miniOrange OTP Login, Verification and SMS Notifications (miniorange-otp-verification) in versions up to and including 5.5.7 contains an incorrect privilege assignment. Based on the public proof of concept, an unauthenticated attacker can take over accounts, including administrator accounts, when the "Login with only OTP" mode is enabled. A public proof of concept exists, and Patchstack rates the issue as high priority.

Affected

• miniOrange OTP Login, Verification and SMS Notifications (slug miniorange-otp-verification): from n/a through 5.5.7
• Patchstack also records a separate unauthenticated authentication bypass affecting versions up to and including 5.5.8 (dated 15 Oct 2026)
• Preconditions: the "Login with only OTP" mode must be enabled for the proof of concept to work

Fixed in

• Version 5.5.8 is named as the fix for this CVE by the PoC repository, OpenCVE and Patchstack
• Patchstack lists 5.6.0 as the latest version; the vendor changelog for 5.5.8 only mentions "Security updates for phone based login" and does not name this CVE
• Recommended target: 5.6.0 or later, because of the later bypass affecting versions up to 5.5.8

Workaround

• Unknown. No vendor-documented workaround was found.
• Not from a source, to be tested first: disable the "Login with only OTP" mode if it is not needed.

Exploitation

• Public proof of concept: yes (GitHub repository by a researcher named KevineCharles, describing unauthenticated account takeover via OTP re-routing)
• Exploited in the wild: unknown, no confirmed reports found
• Conflicting data: VulDB states that no exploit exists and lists CWE-269 and a CVSS of 7.3; CNA and NVD data use CWE-266 and CVSS 9.8
• Patchstack states that mass-exploitation is expected; the SSVC assessment shows exploitation: none and automatable: yes

Our recommendation

• Inventory all WordPress sites running the plugin and record the versions.
• Update to version 5.6.0 or later; treat versions up to and including 5.5.8 as vulnerable.
• Check whether the "Login with only OTP" mode is enabled and disable it if it is not needed.
• Review administrator accounts, recent logins and newly created users, especially since a public proof of concept exists.
• Monitor the vendor and Patchstack pages for updates. NVD scoring is deferred and may change.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  KevineCharles/CVE-2026-106610-miniorange-otp-ato

Research sources

• Patchstack advisory (CVE record reference) patchstack.com
• PoC repository (KevineCharles) github.com
• OpenCVE CVE-2026-106610 app.opencve.io
• NVD metadata via Vulners vulners.com
• WordPress.org plugin page (changelog) wordpress.org
• Patchstack plugin vulnerabilities list patchstack.com
• VulDB CVE-2026-106610 vuldb.com
• Related CVE-2026-103895 (Vulners) vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:44.