CVE-2026-14245 is a critical authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress, affecting all versions up to and including 5.5.1. The vulnerability arises because the function um_reset_password_process_hook() does not verify that the OTP validation step was completed server-side. Instead, it relies solely on a public form_nonce nonce exposed to unauthenticated visitors via JavaScript. Additionally, the plugin accepts an attacker-controlled username_b parameter without role restriction or binding to a validated OTP session. This allows an unauthenticated attacker to generate a password reset URL for any WordPress administrator account, returned in a 302 redirect Location header, enabling full account takeover. Exploitation requires the Ultimate Member Password Reset Form integration to be enabled and the plugin not configured for phone-only reset. There is no official patch or remediation level currently provided by the vendor.

An unauthenticated attacker can bypass OTP validation and reset the password of any administrator account, resulting in complete compromise of the WordPress site with administrative privileges. This leads to full control over the affected site, including potential data theft, site defacement, or further malicious activity. The vulnerability has a CVSS score of 9.8 (critical), reflecting its high impact and ease of exploitation without any privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable the Ultimate Member Password Reset Form integration and/or configure the plugin to enforce phone-only reset to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.