CVE-2026-77771 — miniOrange 2FA (Free & Pro): 2FA Bypass via Session-Scoped OTP Lockout

An authentication bypass in the miniOrange Two-Factor Authentication plugin for WordPress allows an attacker who already holds a victim's valid password to brute-force the second factor without limit, defeating 2FA entirely.

---

Summary

Affected software

Description

The plugin enforces a limit on failed second-factor attempts, but the counter that backs this limit is not scoped to the account under attack. Instead it is keyed to an identifier that is supplied by the client and can be changed freely on each request.

Because the attacker controls the key, every request can be made to land in a fresh counter bucket. The lockout therefore never accumulates against the targeted user, and the number of one-time-passcode guesses an attacker may make is effectively unbounded.

A second validation endpoint in the same plugin performs no attempt limiting at all, so the second factor can be attacked through that path even without manipulating the identifier.

The practical result is that the OTP — a short numeric secret with a small keyspace — can be enumerated within its validity window, and the second authentication factor provides no meaningful protection.

Root cause

• Rate-limit / lockout state is keyed on client-controlled input rather than on the server-side user identity (user ID or login) being authenticated.
• One of the OTP validation entry points is missing attempt limiting entirely.

Preconditions

• The attacker must already possess valid primary credentials (username and password) for the target account — hence PR:L and AC:H in the CVSS vector.
• The target account must have the plugin's second factor enabled; no user interaction is required.

Impact

An attacker in possession of leaked, phished, or reused credentials can complete authentication as the victim despite 2FA being enabled. Where the victim is an administrator, this results in full compromise of the WordPress installation — confidentiality, integrity, and availability are all affected.

Proof of Concept

A proof of concept is intentionally not published here. The issue is fixed upstream; details sufficient to reproduce it are available to the vendor and to WPScan.

High-level reproduction outline:

1. Authenticate to wp-login.php with valid credentials for an account that has the plugin's second factor enabled.
2. Observe the second-factor challenge and the request that submits the one-time passcode.
3. Identify the client-supplied value that the lockout counter is keyed on.
4. Submit incorrect passcodes while varying that value; note that the failed-attempt counter never reaches the configured threshold for the targeted account.
5. Repeat against the second validation endpoint; note that no threshold is enforced there at all.

Remediation

Update the plugin to version 6.3.1 (Free) or 19.3 (Pro) or later.

Defence-in-depth measures for operators who cannot update immediately:

• Apply rate limiting in front of the login and OTP validation endpoints at the web server or WAF layer, keyed on source IP and on the authenticating account.
• Restrict access to wp-login.php and to the plugin's AJAX/REST validation endpoints by IP where feasible.
• Monitor for repeated failed second-factor attempts against a single account and alert on them.
• Rotate credentials for privileged accounts that may have been exposed in third-party breaches.

Guidance for developers implementing a second factor:

• Key all lockout and throttling state to a server-derived identity, never to a value the client can set.
• Enforce the same throttling policy on every code path that can validate a factor.
• Invalidate the OTP after a small fixed number of failures and require the login flow to restart.

Timeline

References

• WPScan advisory: https://wpscan.com/vulnerability/e1e57673-18cb-4157-9d58-547af7101b04/
• WPScan plugin page: https://wpscan.com/plugin/miniorange-2-factor-authentication/
• CVE record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-77771
• WPVDB ID: e1e57673-18cb-4157-9d58-547af7101b04

Credit

Discovered and reported by Pervin Zahidli — https://www.zahidlipervin.site/

Disclaimer

This document is published for defensive and educational purposes. The vulnerability described here is fixed upstream. Testing it against systems you do not own or have explicit written authorisation to assess is illegal.