CVE-2026-12695: Unknown Miniorange 2fa

High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days.

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

Affected products

• Unknown Miniorange 2fa: before 6.2.6 (fixed in 6.2.6)

Published 2026-07-31. Last modified 2026-08-26.