CVE-2026-103895: CWE-287 Improper Authentication in cyberlord92 miniOrange OTP Login, Verification and SMS Notifications
Description
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.
CVSS v3.1
Score 8.1high
Affected software
cyberlord92
miniOrange OTP Login, Verification and SMS Notifications
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-103895 describes an authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress, affecting versions up to and including 5.5.8. The vulnerability arises from the mo_delay_otp_process() function short-circuiting authentication before password validation or administrator intent checks can occur. The Delay OTP grace flag is stored as user_meta keyed only by user ID, lacking binding to session, cookie, IP, or device, enabling attackers to impersonate any user by submitting a known username with the mo_wp_login_intent=otp parameter and any non-empty password. This bypass requires the site to have OTP-only login and Delay OTP Verification enabled, and the targeted account must be within its Delay OTP grace period.
Potential Impact
An attacker can authenticate as any WordPress user, including administrators, without knowing the correct password, leading to full account compromise. This affects confidentiality, integrity, and availability of the affected WordPress site. The vulnerability has a high severity CVSS score of 8.1.
Mitigation Recommendations
No explicit patch or official fix is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable OTP-only login and Delay OTP Verification features to prevent exploitation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-10-01T13:48:24.914Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad1acbb2cdf04f656b600e4
Added to database: 10/16/2026, 04:48:59 UTC
Last enriched: 10/16/2026, 05:04:36 UTC
Last updated: 10/16/2026, 19:03:29 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.