The miniOrange 2FA WordPress plugin versions prior to 6.2.7 contain an improper authentication vulnerability (CWE-287) where the second factor configured during the pre-login two-factor challenge is not properly bound to the existing factor of the target account. An attacker with knowledge of a user's password can exploit this by rebinding the second factor to an attacker-controlled destination, completing the challenge, and taking over the account, including accounts with administrative privileges.

Successful exploitation allows an attacker who knows a user's password to bypass the intended two-factor authentication mechanism by rebinding the second factor to an attacker-controlled destination. This results in full account takeover, including administrator accounts, potentially leading to unauthorized access and control over the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, users should consider additional protective measures such as enforcing strong password policies and monitoring for suspicious login activity, but note these are general recommendations and not specific mitigations for this vulnerability.