Loading story…
A critical authentication bypass and privilege escalation flaw tracked as CVE-2026-61967 affects the miniOrange OTP Verification WordPress plugin in versions <= 5.5.1, allowing unauthenticated attackers to take over accounts, including administrators. The bug occurs in password reset handling when the plugin is used with Ultimate Member: the vulnerable code accepts a publicly exposed WordPress nonce but fails to verify that OTP validation actually happened, enabling attackers to trigger password resets for arbitrary users and recover a valid reset URL and secret hash from the HTTP redirect response.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new vulnerability entry for CVE-2026-61967 was received by audit@patchstack.com on August 13, 2026. The entry describes an unauthenticated privilege-escalation/authentication-bypass flaw affecting miniOrange OTP Verification up to version 5.5.1, with 5.5.2 listed as unaffected.
miniOrange addressed CVE-2026-61967 in OTP Verification version 5.5.2. The fix added OTP session validation, username/session integrity checks, and OTP session cleanup to prevent unauthenticated password-reset abuse when Ultimate Member is used.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
aretiq.ai
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical broken authentication flaw tracked as **CVE-2026-57807** affects the miniOrange **OAuth Single Sign On - SSO (OAuth Client)** WordPress plugin and allows unauthenticated remote attackers to compromise vulnerable sites. The issue impacts plugin versions **through 38.5.8** and is classified as **CWE-288**. According to public reporting and the CVE entry, the bug abuses the plugin's password recovery flow to let an attacker authenticate as arbitrary WordPress users, including administrators, creating a direct path to full website takeover. The vulnerability carries a **CVSS 9.8** rating and is considered low complexity and remotely exploitable with no user interaction required. Patchstack disclosed the issue and warned it is likely to face mass exploitation, while noting that no official vendor patch was available at the time of reporting. Defenders were urged to immediately remove the affected plugin or limit exposure to WordPress login and password recovery endpoints until miniOrange releases a fix; Patchstack also said it had issued a virtual patch for protected customers.
Jul 13, 2026
Multiple critical flaws in widely deployed WordPress plugins exposed sites to administrator takeover through broken REST API authorization, weak JWT handling, and sensitive data leakage. In **Post SMTP**, `CVE-2025-24000` let any authenticated user read administrator-only email logs in versions through `3.2.0`, while `CVE-2025-11833` extended similar exposure to unauthenticated attackers in versions through `3.6.0`; because password reset messages were stored in those logs, attackers could reset admin passwords and seize control of affected sites. **RestroPress** (`CVE-2025-9209`) exposed user tokens through `/wp-json/wp/v2/users`, enabling forged JWTs and full admin access, and **miniOrange OAuth SSO** (`CVE-2025-9485`) accepted forged JWTs because signatures were not verified, allowing login as arbitrary users including administrators. **Copypress Rest API** (`CVE-2025-8625`) combined a hard-coded JWT signing key with unrestricted file upload to enable unauthenticated remote code execution. The pattern continued into active exploitation of **Gravity SMTP** (`CVE-2026-4020`), where an unauthenticated REST API endpoint exposed system reports containing WordPress and server details, plugin inventories, database information, and email-service credentials such as API keys, secrets, and OAuth tokens. Wordfence said exploitation required only a single request, reported blocking more than **17 million** attempts, and urged defenders to upgrade to `2.1.5` and rotate exposed third-party email credentials. Across the affected plugins, vendors issued fixes including **Post SMTP 3.3.0**, **miniOrange 6.26.13**, and **Gravity SMTP 2.1.5**, while the Copypress plugin was temporarily closed; the incidents underscore how exposed REST endpoints and flawed token validation can quickly turn routine plugin features into full site compromise paths.
Jun 29, 2026
A critical authentication bypass vulnerability, tracked as **CVE-2026-15014**, affects the **SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery** WordPress plugin in versions through `3.9.7`. The flaw stems from the plugin trusting a session-level `$_SESSION['sa_mobile_verified']` flag that is not bound to the specific phone number that completed OTP verification. An unauthenticated attacker can verify a phone number they control, then resubmit registration data with a victim’s `billing_phone` value and trigger `wp_set_auth_cookie()` for the victim account. The bug carries a **CVSS 9.8** severity rating and can allow takeover of any existing WordPress user whose registered phone number is known or guessable, including administrators, potentially leading to full site compromise. Reports say public proof-of-concept details are available and exploitation attempts have already been observed. The issue is fixed in version `3.9.8`, and defenders are being urged to update immediately or temporarily disable the plugin while ensuring OTP verification is tied to the verified phone number.
Jul 28, 2026