identity-authentication-vulnerabilityinternet-facing-service-vulnerabilityprivilege-escalation-methodwidely-deployed-product-advisory
Critical miniOrange OTP Verification Flaw Enables WordPress Admin Account Takeover
Vulnerability Disclosure · 2 sources · Updated 3mo ago · First seen Aug 13, 2026
A critical authentication bypass and privilege escalation flaw tracked as CVE-2026-61967 affects the miniOrange OTP Verification WordPress plugin in versions <= 5.5.1, allowing unauthenticated attackers to take over accounts, including administrators. The bug occurs in password reset handling when the plugin is used with Ultimate Member: the vulnerable code accepts a publicly exposed WordPress nonce but fails to verify that OTP validation actually happened, enabling attackers to trigger password resets for arbitrary users and recover a valid reset URL and secret hash from the HTTP redirect response.
Do you run this?See affected versions and whether adversaries are exploiting it.
Check your exposure
