Loading vulnerability…
Authentication Bypass and Account Takeover in miniOrange OTP Verification for WordPress
CVE-2026-61967 is a critical unauthenticated privilege escalation vulnerability in the miniOrange OTP Verification plugin for WordPress affecting version 5.5.1 and earlier. The flaw is present in deployments that use the Ultimate Member password reset functionality with the UM password reset OTP form enabled. In the vulnerable password reset flow, the handler responsible for processing Ultimate Member password resets checks only a publicly exposed WordPress nonce and does not verify that OTP initialization and OTP validation actually occurred before continuing the reset process. As a result, an unauthenticated attacker can submit a password reset request for an arbitrary account, including an administrator account, and cause the application to generate a valid password reset token and return a usable reset link in the HTTP redirect response. The issue effectively bypasses the intended OTP-based verification step and turns the password recovery mechanism into an authentication bypass leading directly to account takeover.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows full takeover of any targeted WordPress account reachable through the affected password reset flow, including administrator accounts. Compromise of an administrator account can lead to complete site compromise, including unauthorized access to sensitive data, modification of site content and configuration, installation of malicious plugins or backdoors, creation of additional privileged accounts, and potential disruption of site availability. The vulnerability is remotely exploitable without authentication and without user interaction, making it suitable for opportunistic or automated exploitation.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the miniOrange OTP Verification integration for the Ultimate Member password reset flow or disable the UM password reset OTP form until the plugin can be updated. Restrict or temporarily disable public password reset functionality for high-value accounts where operationally feasible, and closely monitor password reset activity for anomalous requests and unexpected password change events. Review web and application logs for suspicious password reset POST activity and investigate any unexplained reset operations affecting privileged users.
Patch, then assume compromise.
Upgrade miniOrange OTP Verification to version 5.5.2 or later. The fixed release adds validation that OTP initialization and OTP verification occurred before processing the password reset, verifies that the submitted username matches the username stored in the OTP session, and clears OTP session state after successful validation to prevent replay. After patching, review privileged accounts for unauthorized password changes or newly created administrator users and rotate credentials for potentially affected accounts.
No public exploits tracked yet. Mallory keeps watching.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.