CVE-2026-77770

CriticalCVSS 10.0/10Last modified Sep 10, 2026

Description

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-777717.5The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt lim CVE-2026-777735.3The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session che CVE-2026-777748.6Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could lev CVE-2026-777758.6Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_bas CVE-2026-777769.1Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in h CVE-2026-77785.0An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This i CVE-2026-777805.3Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a CVE-2026-777817.5Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods th CVE-2026-777825.3The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build p CVE-2026-777833.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewab CVE-2026-777842.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating CVE-2026-777852.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post reference