CVE-2026-103895 in miniOrange OTP Login
Summary
by MITRE • 10/16/2026
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress contains a critical authentication bypass vulnerability in versions up to 5.5.8 that allows unauthenticated attackers to assume any user identity without providing valid credentials. This flaw stems from the improper implementation of the Delay OTP feature within the `mo_by_pass_login()` function. When this specific configuration is active, the system short-circuits the standard authentication flow by invoking `mo_delay_otp_process()`. This process checks for a stored grace period flag rather than validating the user's password or enforcing administrative intent gates that were introduced in version 5.5.6 to prevent unauthorized access during OTP delays. Consequently, if an attacker submits any non-empty password alongside a known username and sets the `mo_wp_login_intent` parameter to otp, the system accepts the login attempt as valid provided the target account is currently within its configured Delay OTP interval.
The root cause of this vulnerability lies in how the grace period state is persisted. The plugin stores the delay OTP timestamp using WordPress user metadata keyed solely by the target user ID. This design fails to bind the session token, cookie, IP address, or device fingerprint to the stored verification status. As a result, the system treats any request that references the correct username and falls within the time window as legitimate, regardless of whether it originates from the same browser session or network location where the initial OTP was requested. This lack of contextual binding effectively nullifies the security benefits of two-factor authentication by allowing credential stuffing attacks to succeed without requiring knowledge of the second factor or even the primary password.
Exploitation requires specific configuration states on the target WordPress site. The vulnerability is only exploitable when OTP-only login mode is enabled, indicated by `wp_login_skip_password` being set to 1 and `wp_login_skip_password_fallback` set to 0. Additionally, Delay OTP Verification must be active via `wp_login_delay_otp=1`. Under these conditions, an attacker can authenticate as any user, including administrators with full site control privileges, simply by knowing the username and ensuring their request arrives while the grace period is still open. This capability poses a severe risk to website integrity, data confidentiality, and availability, as attackers gain unrestricted access without triggering typical security alerts associated with failed login attempts or incorrect password submissions.
This vulnerability aligns with CWE-287 Improper Authentication, specifically reflecting failures in session management and credential verification logic. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials or bypass authentication mechanisms entirely to maintain persistent access. To mitigate this risk, administrators should immediately update the miniOrange OTP Login plugin to version 5.5.9 or later, which addresses these session binding issues and reinforces intent verification gates. Until an upgrade is possible, it is advisable to disable Delay OTP Verification features if they are not strictly necessary for operational workflows. Furthermore, implementing additional network-level controls such as IP whitelisting for administrative endpoints can provide a layer of defense against exploitation attempts targeting this specific authentication bypass vector.