## https://sploitus.com/exploit?id=85C533D5-C017-5130-B139-CE37FBD19E1E
# CVE-2026-77771 — miniOrange 2FA (Free & Pro): 2FA Bypass via Session-Scoped OTP Lockout
[](https://vulners.com/cve/CVE-2026-77771)
[](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
[](https://cwe.mitre.org/data/definitions/287.html)
[](#remediation)
An authentication bypass in the miniOrange Two-Factor Authentication plugin for WordPress allows an attacker who already holds a victim's valid password to brute-force the second factor without limit, defeating 2FA entirely.
---
## Summary
| | |
|---|---|
| **CVE ID** | CVE-2026-77771 |
| **Vulnerability type** | Authentication Bypass (AUTHBYPASS) |
| **CWE** | [CWE-287: Improper Authentication](https://cwe.mitre.org/data/definitions/287.html) |
| **OWASP Top 10 (2017)** | [A2: Broken Authentication and Session Management](https://www.owasp.org/index.php/Top_10-2017_A2-Broken_Authentication) |
| **CVSS 3.1 score** | 7.5 (High) |
| **CVSS 3.1 vector** | `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` |
| **Researcher** | Pervin Zahidli (`pervinzahidli`) |
| **Status** | Fixed by vendor |
## Affected software
| Product | Affected versions | Fixed in |
|---|---|---|
| [miniOrange Two-Factor Authentication — Free](https://wpscan.com/plugin/miniorange-2-factor-authentication/) | ` A proof of concept is intentionally not published here. The issue is fixed upstream; details sufficient to reproduce it are available to the vendor and to WPScan.
High-level reproduction outline:
1. Authenticate to `wp-login.php` with valid credentials for an account that has the plugin's second factor enabled.
2. Observe the second-factor challenge and the request that submits the one-time passcode.
3. Identify the client-supplied value that the lockout counter is keyed on.
4. Submit incorrect passcodes while varying that value; note that the failed-attempt counter never reaches the configured threshold for the targeted account.
5. Repeat against the second validation endpoint; note that no threshold is enforced there at all.
## Remediation
**Update the plugin** to version **6.3.1** (Free) or **19.3** (Pro) or later.
Defence-in-depth measures for operators who cannot update immediately:
- Apply rate limiting in front of the login and OTP validation endpoints at the web server or WAF layer, keyed on source IP and on the authenticating account.
- Restrict access to `wp-login.php` and to the plugin's AJAX/REST validation endpoints by IP where feasible.
- Monitor for repeated failed second-factor attempts against a single account and alert on them.
- Rotate credentials for privileged accounts that may have been exposed in third-party breaches.
Guidance for developers implementing a second factor:
- Key all lockout and throttling state to a **server-derived** identity, never to a value the client can set.
- Enforce the same throttling policy on **every** code path that can validate a factor.
- Invalidate the OTP after a small fixed number of failures and require the login flow to restart.
## Timeline
| Date | Event |
|---|---|
| 2026-09-08 | Publicly published |
| 2026-09-08 | Added to WPScan Vulnerability Database |
| 2026-09-09 | Entry last updated |
## References
- WPScan advisory:
- WPScan plugin page:
- CVE record:
- WPVDB ID: `e1e57673-18cb-4157-9d58-547af7101b04`
## Credit
Discovered and reported by **Pervin Zahidli** —
## Disclaimer
This document is published for defensive and educational purposes. The vulnerability described here is fixed upstream. Testing it against systems you do not own or have explicit written authorisation to assess is illegal.