HomeWordPress vulnerabilitiesminiOrange OTP Login, Verification and SMS Notifications
miniOrange OTP Login, Verification and SMS Notifications vulnerabilities
miniOrange OTP Login, Verification and SMS Notifications has 2 known vulnerabilities in this database. The most recent published record is dated 26 Sep 2026.
- Known vulnerabilities
- 2
- Active installs
- 5,000+
- Latest version
- 5.5.7
- Last updated
- 30 Sep 2026
- Most recent
- 26 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Authentication bypass CVE-2026-85984 | Critical 9.8 | Up to 5.5.5 | Fixed in a later version (latest 5.5.7) | 11 d ago |
| Authentication bypass CVE-2026-14245 | Critical 9.8 | Up to 5.5.1 | Fixed in a later version (latest 5.5.7) | 9 Jul 2026 |
Read the published descriptions
- CVE-2026-85984, 26 Sep 2026
- The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass. CVE record
- CVE-2026-14245, 9 Jul 2026
- The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account - returned in a 302 `Location` header - and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset. CVE record
What to do if you run miniOrange OTP Login, Verification and SMS Notifications
If you run miniOrange OTP Login, Verification and SMS Notifications, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new miniOrange OTP Login, Verification and SMS Notifications vulnerabilities
Free. We email you when a new vulnerability is published for miniOrange OTP Login, Verification and SMS Notifications, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.