CVE-2026-77771

HighCVSS 7.5/10Last modified Sep 10, 2026

Description

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Unknown	miniOrange 2FA	>= 6.2.8, < 6.3.1
Unknown	miniOrange 2FA	>= 18.0, < 19.3

References

https://wpscan.com/vulnerability/e1e57673-18cb-4157-9d58-547af7101b04/

Timeline

Published: Sep 10, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-777735.3The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session che CVE-2026-777748.6Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could lev CVE-2026-777758.6Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_bas CVE-2026-777769.1Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in h CVE-2026-777777.1ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modi CVE-2026-777787.1ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to thei CVE-2026-777797.7ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated lo CVE-2026-77785.0An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This i CVE-2026-777805.3Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a CVE-2026-777817.5Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods th CVE-2026-777825.3The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build p CVE-2026-777833.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewab