WordPress plugin
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 17 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High5
- Medium11
- Low1
All miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.3 | 6.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion ≤19.2Update to 19.3 or 6.3.1 | CVE-2026-77770 | |
| High7.5 | Missing Authorization to Plugin Settings Change ≤5.6.5Update to 5.6.6 | CVE-2022-4943 | |
| High7.5 | Sensitive Data Exposure of Multifactor Backup Codes ≤5.6.1Update to 5.6.2 | CVE-2022-44589 | |
| High8.8 | Cross-Site Request Forgery to Malware Scan Termination ≤5.6.1Update to 5.6.2 | — | |
| High8.1 | Unauthenticated Arbitrary Options Deletion ≤5.4.52Update to 5.5 | CVE-2022-0229 |
- High7.36.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion
≤19.2Update to 19.3 or 6.3.1
- High7.5Missing Authorization to Plugin Settings Change
≤5.6.5Update to 5.6.6
- High7.5Sensitive Data Exposure of Multifactor Backup Codes
≤5.6.1Update to 5.6.2
- High8.8Cross-Site Request Forgery to Malware Scan Termination
≤5.6.1Update to 5.6.2
- High8.1Unauthenticated Arbitrary Options Deletion
≤5.4.52Update to 5.5
miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator): common questions
Does miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) have known vulnerabilities?
Yes. VulnCrest Radar lists 17 known vulnerabilities in miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator): 5 high, 11 medium, 1 low. None are known to affect version null.
How do I check which version of miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerability?
CVE-2026-111949, published Oct 19, 2026: miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 - 6.3.0 - Two-Factor Authentication Bypass. Severity: Medium (CVSS 4.3).
Is any miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerability listed in CISA KEV?
No. None of the known miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) vulnerabilities is currently listed in the CISA KEV catalog.