WordPress plugin
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High5
- Medium11
- Low1
All miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | 6.3.0 - Two-Factor Authentication Bypass 6.2.9 – 6.3.0Update to 6.3.1 | CVE-2026-111949 | |
| High7.3 | 6.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion ≤19.2Update to 19.3 or 6.3.1 | CVE-2026-77770 | |
| Medium5.3 | 6.3.0 - Unauthenticated Second Factor Authentication Bypass ≤19.2Update to 19.3 or 6.3.1 | CVE-2026-77771 | |
| Low3.1 | Two-Factor Authentication Bypass via Brute Force ≤6.2.7Update to 6.2.8 | CVE-2026-16619 | |
| Medium4.3 | Two-Factor Authentication Bypass ≤6.2.6Update to 6.2.7 | CVE-2026-16036 | |
| Medium4.3 | Missing Authorization ≤6.2.6Update to 6.2.7 | CVE-2026-16035 | |
| Medium5.3 | Two-Factor Authentication Bypass <6.2.6Update to 6.2.6 | CVE-2026-12695 | |
| Medium4.3 | Missing Authorization ≤6.1.1Update to 6.1.2 | CVE-2025-54745 | |
| High7.5 | Missing Authorization to Plugin Settings Change ≤5.6.5Update to 5.6.6 | CVE-2022-4943 | |
| High7.5 | Sensitive Data Exposure of Multifactor Backup Codes ≤5.6.1Update to 5.6.2 | CVE-2022-44589 | |
| High8.8 | Cross-Site Request Forgery to Malware Scan Termination ≤5.6.1Update to 5.6.2 | — | |
| Medium5.4 | Missing Authorization to Plugin Settings Change ≤5.6.1Update to 5.6.2 | CVE-2022-42461 | |
| Medium6.3 | Missing Authorization ≤5.5.82Update to 5.6.0 | — | |
| Medium6.1 | Reflected Cross-Site Scripting ≤5.5.7Update to 5.5.75 | — | |
| Medium5.5 | Authenticated (Admin+) Cross-Site Scripting ≤5.5.5Update to 5.5.6 | CVE-2022-1321 | |
| High8.1 | Unauthenticated Arbitrary Options Deletion ≤5.4.52Update to 5.5 | CVE-2022-0229 | |
| Medium6.1 | Cross-Site Scripting ≤5.4.39Update to 5.4.40 | — |
- Medium4.36.3.0 - Two-Factor Authentication Bypass
6.2.9 – 6.3.0Update to 6.3.1
- High7.36.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion
≤19.2Update to 19.3 or 6.3.1
- Medium5.36.3.0 - Unauthenticated Second Factor Authentication Bypass
≤19.2Update to 19.3 or 6.3.1
- Low3.1Two-Factor Authentication Bypass via Brute Force
≤6.2.7Update to 6.2.8
- Medium4.3Two-Factor Authentication Bypass
≤6.2.6Update to 6.2.7
- Medium4.3Missing Authorization
≤6.2.6Update to 6.2.7
- Medium5.3Two-Factor Authentication Bypass
<6.2.6Update to 6.2.6
- Medium4.3Missing Authorization
≤6.1.1Update to 6.1.2
- High7.5Missing Authorization to Plugin Settings Change
≤5.6.5Update to 5.6.6
- High7.5Sensitive Data Exposure of Multifactor Backup Codes
≤5.6.1Update to 5.6.2
- High8.8Cross-Site Request Forgery to Malware Scan Termination
≤5.6.1Update to 5.6.2
- Medium5.4Missing Authorization to Plugin Settings Change
≤5.6.1Update to 5.6.2
- Medium6.3Missing Authorization
≤5.5.82Update to 5.6.0
- Medium6.1Reflected Cross-Site Scripting
≤5.5.7Update to 5.5.75
- Medium5.5Authenticated (Admin+) Cross-Site Scripting
≤5.5.5Update to 5.5.6
- High8.1Unauthenticated Arbitrary Options Deletion
≤5.4.52Update to 5.5
- Medium6.1Cross-Site Scripting
≤5.4.39Update to 5.4.40
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator): common questions
Does miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator): 5 high, 11 medium, 1 low. None are known to affect version null.
How do I check which version of miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerability?
CVE-2026-111949, published Oct 19, 2026: miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 - 6.3.0 - Two-Factor Authentication Bypass. Severity: Medium (CVSS 4.3).
Is any miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerability listed in CISA KEV?
No. None of the known miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerabilities is currently listed in the CISA KEV catalog.