CVE-2026-85984 is an authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress, affecting all versions up to and including 5.5.5. The issue arises from a missing password-intent guard in the skip_pass_fallback-enabled branch of the mo_by_pass_login() function. When the POST parameter mo_wp_login_intent is set to 'otp', the function bypasses password and OTP verification and authenticates users solely based on username lookup if the user has administrator role membership. This allows unauthenticated attackers to log in as any administrator by providing only a known username and the mo_wp_login_intent=otp parameter, without supplying a password or OTP. Exploitation depends on the simultaneous enabling of the plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.

An unauthenticated attacker can gain administrator access to a vulnerable WordPress site by bypassing authentication controls, potentially leading to full site compromise including data theft, site defacement, or further malicious activity. The vulnerability has a critical severity with a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability.

No explicit patch or fix is indicated in the provided data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the combination of plugin options that enable this bypass (WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass) to mitigate risk.