CVE-2026-12695— miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
Quick assessment
Affected
Unknown miniOrange 2FA
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress miniOrange 2FA是WordPress基金会的一款提供双因素认证功能的网站安全插件。 WordPress miniOrange 2FA 6.2.6之前版本存在授权问题漏洞，该漏洞源于未对提交的一次性密码与目标用户存储的密钥进行验证，而是验证攻击者提供的值，可能导致知道受害者密码的未认证攻击者绕过双因素认证并获取包括管理员在内的受害者账户访问权限。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | miniOrange 2FA | < 6.2.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12695
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret
Source: CVE Program / CVE List V5
Vulnerability Description
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress miniOrange 2FA 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress miniOrange 2FA是WordPress基金会的一款提供双因素认证功能的网站安全插件。 WordPress miniOrange 2FA 6.2.6之前版本存在授权问题漏洞，该漏洞源于未对提交的一次性密码与目标用户存储的密钥进行验证，而是验证攻击者提供的值，可能导致知道受害者密码的未认证攻击者绕过双因素认证并获取包括管理员在内的受害者账户访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | miniOrange 2FA | 0 ~ 6.2.6 | - |
|
II. Public POCs for CVE-2026-12695
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12695
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12695 (1)
-
🔗 miniOrange 2FA < 6.2.6 – 2FA Bypass via Attacker-Controlled ga_secret | CVE 2026-12695 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-07-31 · 34 CVEs total
| CVE-2026-12720 | Kirki < 6.0.13 - Unauthenticated PHP Object Injection | |
| CVE-2026-14931 | JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure | |
| CVE-2026-14930 | JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload | |
| CVE-2026-15381 | WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter | |
| CVE-2026-15209 | JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Supp | |
| CVE-2026-15258 | Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter | |
| CVE-2026-12251 | Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field | |
| CVE-2026-8155 | BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR | |
| CVE-2026-12376 | Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST | |
| CVE-2026-14929 | JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR | |
| CVE-2026-12721 | Kirki < 6.0.13 - Unauthenticated SQL Injection | |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Sett | |
| CVE-2026-13392 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget B | |
| CVE-2026-14862 | Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Autho | |
| CVE-2026-14919 | ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset | |
| CVE-2026-12697 | wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR | |
| CVE-2026-13609 | Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Fo | |
| CVE-2026-14333 | Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive | |
| CVE-2026-15048 | GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History | |
| CVE-2026-14927 | FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: miniOrange 2FA
-
CVE-2026-77770
miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Opti -
CVE-2026-77771
miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped -
CVE-2026-16619
miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Fac -
CVE-2026-16036
miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second -
CVE-2026-16035
miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP
Same vendor: Unknown
-
CVE-2026-93549
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via RE -
CVE-2026-97332
User Private Files < 2.2.0 - Unauthenticated Private File Di -
CVE-2026-86817
Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Auth -
CVE-2026-17005
Horizontal Scrolling Announcements <= 2.6 - Contributor+ Sto -
CVE-2026-104118
Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shi
V. Comments for CVE-2026-12695
No comments yet