CVE-2026-14245 is a critical authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress. The vulnerability is due to the `um_reset_password_process_hook()` function lacking server-side verification that the OTP validation step has been completed. Instead, it relies solely on a public `form_nonce` nonce exposed to unauthenticated visitors via JavaScript. Additionally, the function accepts an attacker-controlled `username_b` parameter without role restrictions or binding to a validated OTP session. This enables unauthenticated attackers to obtain a password reset URL for any WordPress user, including administrators, via a 302 redirect, allowing full account takeover. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin not configured for phone-only reset. No official patch or remediation guidance is currently provided.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and take over administrator accounts by generating valid password reset URLs. This leads to complete compromise of the WordPress site, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 9.8 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to disable the Ultimate Member Password Reset Form integration and/or configure the plugin to enforce phone-only password resets to mitigate the risk. Monitor vendor channels for updates and apply official patches once released.