Is miniOrange 2FA safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (6.6.0). As of 2026-11-04. 11 issues are on record for older versions; version 6.3.1 or newer fixes all of them that state a fix. Keep miniOrange 2FA on the latest version (6.6.0) and remove it if you do not use it.

Which versions of miniOrange 2FA are vulnerable?

Known issues on record (newest first): Authentication bypass (6.2.9 up to (not including) 6.3.1, fixed in 6.3.1); Authentication bypass (6.2.8 up to (not including) 6.3.1, 18.0 up to (not including) 19.3, fixed in 6.3.1); Missing authorization check (5.3.24 up to (not including) 6.3.1, 18.0 up to (not including) 19.3, fixed in 6.3.1); Security issue (older than 6.2.8, fixed in 6.2.8); Authentication bypass (older than 6.2.7, fixed in 6.2.7); Missing authorization check (older than 6.2.7, fixed in 6.2.7). The full list with sources is on this page.

What is the latest version of miniOrange 2FA?

6.6.0, according to wordpress.org (last updated 2026-11-02). It has 10,000+ active installs.

What should I do if my miniOrange 2FA is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update miniorange-2-factor-authentication). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · miniorange-2-factor-authentication · data as of 2026-11-04

Is miniOrange 2FA safe? Known vulnerabilities and latest version

Latest version: 6.6.0
Last updated: 2026-11-02
Active installs: 10,000+
Known issues on record: 11
Unpatched in latest: 0
Tested up to WP: 7.1.4 · PHP 5.3.0+

Free 2FA plugin for unlimited users with Passkey, Google Authenticator, Email/SMS OTP, Push Notification & passwordless login. — by miniOrange

What to do

Update to the latest version (6.6.0). Anything older than 6.3.1 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get miniorange-2-factor-authentication --field=version shows what you run; wp plugin update miniorange-2-factor-authentication updates it.

Check your version

Known vulnerabilities

11 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

high 7.5 CVE-2026-111949 · published 2026-10-21

Authentication bypass in miniOrange 2FA (6.2.9 up to (not including) 6.3.1)

Affected: 6.2.9 up to (not including) 6.3.1
Fixed in: 6.3.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.

NVD CVE-2026-111949 WPScan advisory

high 7.5 CVE-2026-77771 · published 2026-09-10

Authentication bypass in miniOrange 2FA (6.2.8 up to (not including) 6.3.1, 18.0 up to (not including) 19.3)

Affected: 6.2.8 up to (not including) 6.3.1, 18.0 up to (not including) 19.3
Fixed in: 6.3.1
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest miniOrange 2FA release on wordpress.org (6.6.0), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a victim's password to make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.

NVD CVE-2026-77771 WPScan advisory

critical 10.0 CVE-2026-77770 · published 2026-09-10

Missing authorization check in miniOrange 2FA (5.3.24 up to (not including) 6.3.1, 18.0 up to (not including) 19.3)

Affected: 5.3.24 up to (not including) 6.3.1, 18.0 up to (not including) 19.3
Fixed in: 6.3.1
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

NVD CVE-2026-77770 WPScan advisory

high 7.5 CVE-2026-16619 · published 2026-08-06

Security issue in miniOrange 2FA (older than 6.2.8)

Affected: older than 6.2.8
Fixed in: 6.2.8
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by WPScan

Details from the advisory

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.

NVD CVE-2026-16619 WPScan advisory

high 7.5 CVE-2026-16036 · published 2026-08-05

Authentication bypass in miniOrange 2FA (older than 6.2.7)

Affected: older than 6.2.7
Fixed in: 6.2.7
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.

NVD CVE-2026-16036 WPScan advisory

medium 4.3 CVE-2026-16035 · published 2026-08-04

Missing authorization check in miniOrange 2FA (older than 6.2.7)

Affected: older than 6.2.7
Fixed in: 6.2.7
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.

NVD CVE-2026-16035 WPScan advisory

high 8.1 CVE-2026-12695 · published 2026-07-31

Authentication bypass in miniOrange 2FA (older than 6.2.6)

Affected: older than 6.2.6
Fixed in: 6.2.6
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.

NVD CVE-2026-12695 WPScan advisory

medium 6.5 CVE-2025-54745 · published 2025-12-18

Missing authorization check in miniOrange 2FA (6.1.1 and older)

Affected: 6.1.1 and older
Fixed in: 6.1.2
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by Patchstack

Details from the advisory

Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.

NVD CVE-2025-54745 Patchstack advisory

high 7.5 CVE-2022-44589 · published 2023-12-29

Information disclosure in miniOrange 2FA (5.6.1 and older)

Affected: 5.6.1 and older
Fixed in: 5.6.2
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.

NVD CVE-2022-44589 Patchstack advisory

medium 5.3 CVE-2022-4943 · published 2023-10-20

Missing authorization check in miniOrange 2FA (5.6.5 and older)

Affected: 5.6.5 and older
Fixed in: 5.6.6 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings.

NVD CVE-2022-4943 Wordfence advisory Code change (fix)

high 8.8 CVE-2022-42461 · published 2022-11-18

Missing authorization check in miniOrange 2FA (5.6.1 and older)

Affected: 5.6.1 and older
Fixed in: 5.6.2 *
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

NVD CVE-2022-42461 Patchstack advisory

Recent activity

2026-11-02 — latest release on wordpress.org (6.6.0).
2026-10-21 — Authentication bypass disclosed (CVE-2026-111949), fixed in 6.3.1.
2026-09-10 — Authentication bypass disclosed (CVE-2026-77771), fixed in 6.3.1.
2026-09-10 — Missing authorization check disclosed (CVE-2026-77770), fixed in 6.3.1.

Free. We check the CVE feeds every day and email you only when a new issue for miniOrange 2FA (miniorange-2-factor-authentication) is published or a fix ships. Unsubscribe in one click.

Browse vulnerabilities

Types found in this plugin: Missing authorization (5) · Authentication bypass (4) · Sensitive data exposure (1)

Where this data comes from

Version, last update, installs: wordpress.org/plugins/miniorange-2-factor-authentication (Plugins API), fetched 2026-11-04.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/miniorange-2-factor-authentication"><img src="https://laskyr.com/plugins/miniorange-2-factor-authentication/badge.svg" alt="miniOrange 2FA vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is miniOrange 2FA safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (6.6.0)

What to do

Check your version

Known vulnerabilities

Authentication bypass in miniOrange 2FA (6.2.9 up to (not including) 6.3.1)

Authentication bypass in miniOrange 2FA (6.2.8 up to (not including) 6.3.1, 18.0 up to (not including) 19.3)

Missing authorization check in miniOrange 2FA (5.3.24 up to (not including) 6.3.1, 18.0 up to (not including) 19.3)

Security issue in miniOrange 2FA (older than 6.2.8)

Authentication bypass in miniOrange 2FA (older than 6.2.7)

Missing authorization check in miniOrange 2FA (older than 6.2.7)

Authentication bypass in miniOrange 2FA (older than 6.2.6)

Missing authorization check in miniOrange 2FA (6.1.1 and older)

Information disclosure in miniOrange 2FA (5.6.1 and older)

Missing authorization check in miniOrange 2FA (5.6.5 and older)

Missing authorization check in miniOrange 2FA (5.6.1 and older)

Recent activity

Get an email when miniOrange 2FA has a new vulnerability

Browse vulnerabilities

Where this data comes from