The miniOrange 2FA WordPress plugin versions prior to 6.2.8 contain a vulnerability that fails to properly limit the number of second-factor authentication attempts. This flaw allows an attacker who already knows a user's password to repeatedly guess the one-time code without restriction, potentially leading to account takeover.