Summary
CVE-2026-12695 is an improper authentication (2FA bypass) vulnerability in the miniOrange 2FA plugin for WordPress in all versions before 6.2.6. The plugin validates a submitted one-time password against an attacker-supplied value instead of the targeted user’s stored secret, allowing an unauthenticated attacker who knows a victim’s password to bypass two-factor authentication and take over accounts, including administrators. It carries a CVSS v3.1 base score of 8.1 (High).
Technical details
- Root cause: A logic flaw in one-time password (OTP) validation (CWE-287, Improper Authentication). The plugin verifies the submitted OTP against an attacker-controlled value rather than the secret stored for the target user.
- Trigger conditions: An attacker must already know the victim’s account password; they can then satisfy the second-factor check with a value they themselves supply.
- Attack vector: Network, no privileges and no user interaction required (high attack complexity).
- Impact: Full bypass of 2FA protection, resulting in account takeover up to and including administrator accounts.
Affected software
- miniOrange 2FA (WordPress plugin): all versions before 6.2.6.
Severity
- CVSS v3.1 base score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Update the miniOrange 2FA plugin to version 6.2.6 or later.
- If no patch can be applied: Restrict access to WordPress login and admin endpoints at the network or WAF layer, enforce strong and unique account passwords, and monitor for anomalous authentication activity until the update is applied.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw response body:
/wp-content/plugins/miniorange-2-factor-authentication/

