miniOrange OTP Login, Verification and SMS Notifications Plugin Password Reset um_reset_password_process_hook password recovery

Summaryinfo

A vulnerability has been found in miniOrange OTP Login, Verification and SMS Notifications Plugin up to 5.5.1 and classified as critical. This vulnerability affects the function um_reset_password_process_hook of the component Password Reset. This manipulation of the argument username_b causes password recovery. The identification of this vulnerability is CVE-2026-14245. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in miniOrange OTP Login, Verification and SMS Notifications Plugin up to 5.5.1 and classified as critical. Affected by this vulnerability is the function um_reset_password_process_hook of the component Password Reset. The manipulation of the argument username_b with an unknown input leads to a password recovery vulnerability. The CWE definition for the vulnerability is CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account — returned in a 302 `Location` header — and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.

The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-14245 since 06/30/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/09/2026). MITRE ATT&CK project uses the attack technique T1552 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-42543). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• miniOrange

Name

• OTP Login, Verification and SMS Notifications Plugin

Version

• 5.5.0
• 5.5.1

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion