Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-85984 — Python PoC for CVE-2026-85984: checks and exploits the miniOrange OTP plugin (≤5.5.5) unauthenticated WordPress admin auth bypass, with version scan and user enumeration. | Kitploit
Tools/GitHubGitHub/murrez/cve-2026-85984
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringWeb SecurityPenetration TestingAuthentication
GitHubmurrez/cve-2026-85984

CVE-2026-85984

Python PoC for CVE-2026-85984: checks and exploits the miniOrange OTP plugin (≤5.5.5) unauthenticated WordPress admin auth bypass, with version scan and user enumeration.

View Repository
131 month agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-85984 — miniOrange OTP Login (Auth Bypass)

Python 3 PoC for CVE-2026-85984 — miniOrange OTP Login, Verification and SMS Notifications ≤ 5.5.5.

Description (PoCbit / GitHub)

CVE-2026-85984 — Unauthenticated authentication bypass (CWE-287) via POST parameter mo_wp_login_intent=otp with an empty password. In the skip_pass_fallback branch of mo_by_pass_login(), the plugin skips wp_authenticate_username_password(), resolves the user by username only, and treats administrator role as sufficient when Admin OTP Bypass options are enabled.

Attack: wp-login.php with log=<admin_user>, pwd= (empty), mo_wp_login_intent=otp.

Conditions (all must be enabled by site admin):

  1. WP Login OTP
  2. Login with Only OTP
  3. Allow Users to Login with Username and Password
  4. Admin OTP Bypass

CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Fix: 5.5.6+ (Wordfence CNA, finder Supakiad S. / m3ez).

PoC page: https://pocbit.org/pocs/cve-2026-85984

PoCbit

Catalog: https://pocbit.org/pocs/

Plugin slugminiorange-otp-verification
Affected≤ 5.5.5
Fixed5.5.6+
Vectorwp-login.php + mo_wp_login_intent=otp
ImpactAdministrator session (full site compromise)

PoC includes colorized CLI banner, plugin/version scan, optional user enum (REST/author), --mode exploit bypass attempt, mass JSONL with pocbit / pocbit_catalog / pocbit_page.

Usage

pip install -r requirements.txt

python poc.py -u https://wordpress.example --mode check
python poc.py -u https://wordpress.example --mode check --probe-login
python poc.py -u https://wordpress.example --mode exploit --username admin
python poc.py --list targets.example.txt --mode exploit -j 8
python poc.py -u https://wordpress.example --mode exploit --no-color

FOFA / hunt

body="/wp-content/plugins/miniorange-otp-verification"
body="mo_wp_login_intent"

GitHub About (EN)

CVE-2026-85984 PoC: WordPress miniOrange OTP ≤5.5.5 unauth admin bypass via mo_wp_login_intent=otp + empty password. Check/exploit modes, colored CLI. PoCbit

Özet (TR)

CVE-2026-85984: miniOrange OTP eklentisinde boş şifre + mo_wp_login_intent=otp ile admin oturumu (yanlış OTP ayarları gerekir). 5.5.6 yaması. PoC: renkli arayüz + exploit modu.

Legal

Authorized testing only. Do not use on systems you do not own or lack permission to test.

Download Tool