CVE-2026-61967— WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
Possible ATT&CK Techniques 2AI
T1068 · Exploitation for Privilege Escalation T1078.003 · Local AccountsAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| miniOrange | miniorange otp verification | n/a≤ 5.5.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-61967
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5
Vulnerability Title
miniorange otp verification 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
miniorange otp verification是miniorange公司的一款OTP验证软件。 miniorange otp verification 5.5.1及之前版本存在授权问题漏洞，该漏洞源于未经身份验证的权限提升，可能导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| miniOrange | miniorange otp verification | n/a ~ 5.5.1 | - |
II. Public POCs for CVE-2026-61967
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-61967
请登录查看更多情报信息。
Other References for CVE-2026-61967 (1)
Same Patch Batch · miniOrange · 2026-08-13 · 5 CVEs total
| CVE-2026-28008 | 9.8 CRITICAL | WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authenticatio |
| CVE-2026-28149 | 9.8 CRITICAL | WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability |
| CVE-2026-28148 | 9.8 CRITICAL | WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability |
| CVE-2026-61979 | 8.1 HIGH | WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability |
IV. Related Vulnerabilities
Same vendor: miniOrange
- CVE-2026-73351
WordPress WordPress Social Login and Register plugin <= 7.8. - CVE-2026-61979
WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege - CVE-2026-28148
WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vul - CVE-2026-28149
WordPress Headless Single Sign On plugin <= 1.6 - PHP Object - CVE-2026-28008
WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <
Same weakness: CWE-640
- CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated accoun - CVE-2026-15689
Dancer2::Plugin::Auth::Extensible versions through 0.713 for - CVE-2026-12949
Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeov - CVE-2026-72856
Budibase before 3.40.0 Authentication Bypass via Tenant Owne - CVE-2026-66691
WordPress Nokri theme <= 1.6.6 - Broken Access Control vulne
V. Comments for CVE-2026-61967
No comments yet