Unknown Miniorange 2fa vulnerabilities

6 CVEs affecting Unknown Miniorange 2fa, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-77771, published 2026-09-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-77770, published 2026-09-10. Critical severity, CVSS 10.0. EPSS: 0.4% chance of exploitation in the next 30 days. The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from…
CVE-2026-16036, published 2026-08-05. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an…
CVE-2026-16035, published 2026-08-04. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing…
CVE-2026-77771, published 2026-09-10. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an…
CVE-2026-16619, published 2026-08-06. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on…
CVE-2026-12695, published 2026-07-31. High severity, CVSS 8.1. EPSS: 0.3% chance of exploitation in the next 30 days. The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value,…