CVE-2026-14245

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account — returned in a 302 `Location` header — and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.

• CWE-862

• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.0/handler/forms/class-moumpasswordreset.php#L181
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.0/handler/forms/class-moumpasswordreset.php#L367
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.0/handler/forms/class-moumpasswordreset.php#L372
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.0/handler/forms/class-moumpasswordreset.php#L98
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.1/handler/forms/class-moumpasswordreset.php#L181
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.1/handler/forms/class-moumpasswordreset.php#L367
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.1/handler/forms/class-moumpasswordreset.php#L372
• https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.1/handler/forms/class-moumpasswordreset.php#L98
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3595061%40miniorange-otp-verification&new=3595061%40miniorange-otp-verification
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d34f4e77-f384-4d84-be32-0d349962b614?source=cve

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-14238The vitepos WordPress plugin before 3.6.0 does not sanitize …4.1
• CVE-2026-14239The tourmaster WordPress plugin before 5.4.8 does not perfor…7.1
• CVE-2026-1424A vulnerability was identified in PHPGurukul News Portal 1.0…7.2
• CVE-2026-14240The tourmaster WordPress plugin before 5.4.9 writes its orde…5.3
• CVE-2026-14241Memory safety bugs present in Firefox 152.0.3. Some of these…9.8
• CVE-2026-14244The Jssor Slider by jssor.com plugin for WordPress is vulner…7.5
• CVE-2026-14249The Request a Quote plugin for WordPress is vulnerable to Co…7.5
• CVE-2026-1425A security flaw has been discovered in pymumu SmartDNS up to…6.3
• CVE-2026-14250The Themehunk Login Registration plugin for WordPress is vul…6.3
• CVE-2026-14251A flaw was found in the OpenShift GitOps operator. The Clust…7.7
• CVE-2026-14253Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-14254A race condition in the account lockout mechanism in Delphix…8.3