CVE-2026-103895

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.

• CWE-287

• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1050
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1170
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1519
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1573
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L511
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261
• https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wploginform.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-103878Cleartext transmission of sensitive information vulnerabilit…7.5
• CVE-2026-103880Asymmetric Resource Consumption vulnerability in Apache Dire…7.5
• CVE-2026-103884A flaw was found in the X.509 client certificate authenticat…6.5
• CVE-2026-103885Asymmetric Resource Consumption vulnerability in Apache Dire…7.5
• CVE-2026-103888The WPC Smart Quick View for WooCommerce plugin for WordPres…6.1
• CVE-2026-103889The 3D Product configurator for WooCommerce plugin for WordP…9.8
• CVE-2026-103896The 10Web Booster – Website speed optimization, Cache & Page…7.5
• CVE-2026-103897The Responsive Lightbox & Gallery plugin for WordPress is vu…4.4
• CVE-2026-103899The EU VAT Assistant for WooCommerce plugin for WordPress is…7.2
• CVE-2026-103902Improper verification of cryptographic signature vulnerabili…7.5
• CVE-2026-103903An incorrect authorization vulnerability in the WinBox authe…8.8
• CVE-2026-103904The public consent endpoint of JTL-Shop accepts arbitrary co…9.3