CVE-2026-77770criticalCWE-862

CVE-2026-77770: critical vulnerability in miniOrange 2FA

miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

Published

Follow this CVE+ Monitor 2FA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 10epss 0.4%
from disclosure to weapon3 days
Published on NVDSep 10
1st PoC+3d
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Affected products
Unknown · miniOrange 2FA
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — miniOrange 2FA

In the same product, most dangerous first.

CVE-2026-12695HIGHminiOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secretEPSS 0.5%CVE-2026-16036HIGHminiOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor RebindingEPSS 0.4%CVE-2026-16035MEDIUMminiOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP SendEPSS 0.3%CVE-2026-77771HIGHminiOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP LockoutEPSS 0.3%CVE-2026-16619HIGHminiOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor AttemptsEPSS 0.3%CVE-2026-111949HIGHminiOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor RebindingEPSS 0.3%