Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103895— miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

Quick assessment

Affected
cyberlord92 miniOrange OTP Login, Verification and SMS Notifications
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 miniOrange OTP 登录、验证及短信通知插件在 5.5.8 及更早版本中存在身份验证绕过漏洞，该漏洞源于 函数。其根本原因在于： 函数在密码验证或管理员意图校验门（该功能于 5.5.6 版本引入）执行之前，便短路中断了认证流程；同时，延迟 OTP 宽限期标志（ ）仅以目标用户 ID 作为键值存储在 表中，未与发起会话、Cookie、IP 地址或设备进行任何绑定。 这使得未认证的攻击者能够仅通过提交已知用户名（并附带 参数）以及任意非空密码，即可冒充任何 WordPress 用户（包

CVSS 8.1 · High EPSS 0.43% · P35

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
cyberlord92 miniOrange OTP Login, Verification and SMS Notifications ≤ 5.5.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103895

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State
Source: CVE Program / CVE List V5
Vulnerability Description
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cyberlord92 miniOrange OTP Login, Verification and SMS Notifications 0 ~ 5.5.8 -

II. Public POCs for CVE-2026-103895

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103895

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-103895 (1)

Vendor Advisories for CVE-2026-103895 (1)

Vendor Pages for CVE-2026-103895 (1)

IV. Related Vulnerabilities

Same product: miniOrange OTP Login, Verification and SMS Notifications
Same vendor: cyberlord92
Same weakness: CWE-287

V. Comments for CVE-2026-103895

No comments yet

Leave a comment