CVE-2026-77771

The miniOrange 2FA WordPress plugin does not scope its second-factor attempt limit to the account being attacked, instead keying it to an identifier supplied by the client that the attacker can freely change. Because of this, an attacker can reset the attempt counter at will and make an unlimited number of one-time-passcode guesses; a second validation endpoint applies no attempt limit at all. An attacker who already knows a victim's password can therefore brute-force the OTP and defeat the second factor, gaining access to the victim's account (CVSS 3.1: 7.5 High). Any WordPress site running the miniOrange 2FA plugin in versions before 6.3.1 or before 19.3 is affected. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is currently known.

What to do: Upgrade the miniOrange 2FA plugin to version 6.3.1 or later (or 19.3 or later on the affected version series). Until patched, add rate limiting on OTP validation requests at the web application firewall or reverse proxy level, and review authentication logs for an unusually high volume of one-time-passcode attempts against individual accounts. Because exploitation requires the attacker to already know the victim's password, enforcing strong credentials also reduces practical risk.