The miniOrange 2FA WordPress plugin before version 6.3.1 does not correctly scope the limit on second-factor authentication attempts to the victim's account. Instead, it keys the attempt limit to a client-controlled identifier, which an attacker can manipulate. This allows unlimited guesses of one-time passcodes if the attacker knows the victim's password, defeating the second-factor mechanism. Furthermore, a secondary validation endpoint lacks any attempt limit, exacerbating the issue. No CVSS score or official remediation level is provided, and no patch links are available in the data.

An attacker who has obtained a victim's password can bypass the second-factor authentication by making unlimited guesses of the one-time passcode, potentially gaining unauthorized access to the victim's account. This undermines the security benefits of two-factor authentication in affected versions of the miniOrange 2FA plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the miniOrange 2FA plugin or implementing additional protective controls to limit authentication attempts. Monitor vendor communications for updates on patches or official mitigations.