CVE-2026-103895: miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

Q: Which deployments are exposed to this bypass?

Exposure requires both OTP-only login to be enabled (wp_login_skip_password=1 and wp_login_skip_password_fallback=0) and Delay OTP Verification to be enabled (wp_login_delay_otp=1). The affected account must also be inside its configured Delay OTP grace interval.

Q: What does an attacker need to exploit it?

An attacker needs only a known WordPress username, the mo_wp_login_intent=otp parameter, and any non-empty password. No valid credentials, OTP, session, cookie, source IP, or device association is required.

Q: Which accounts are at risk during an active grace window?

Any WordPress account with an active Delay OTP grace window can be impersonated, including administrator accounts. The grace-state user_meta value is keyed only to the target user ID, so it is not tied to the legitimate user's originating session or device.

Q: What can be changed if updating is not immediately possible?

Disable Delay OTP Verification or stop using the specified OTP-only login configuration. The described attack requires both features to be enabled simultaneously.

Published Oct 16, 2026

Updated

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the mobypasslogin() function. This is due to modelayotpprocess() short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (movlastverifieddttm) being stored as a usermeta row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the mowploginintent=otp parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (wploginskippassword=1, wploginskippasswordfallback=0) and Delay OTP Verification (wplogindelayotp=1) enabled, and the target account must currently be within its configured Delay OTP interval.

Affected Software

1 affected component

miniOrange OTP Login, Verification and SMS Notifications for WordPress<=5.5.8

Event History

Oct 16, 2026

CVE Published

via MITRE·04:26 AM

Data Sourced

via MITRE·04:26 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this bypass?

Exposure requires both OTP-only login to be enabled (wp_login_skip_password=1 and wp_login_skip_password_fallback=0) and Delay OTP Verification to be enabled (wp_login_delay_otp=1). The affected account must also be inside its configured Delay OTP grace interval.

What does an attacker need to exploit it?

An attacker needs only a known WordPress username, the mo_wp_login_intent=otp parameter, and any non-empty password. No valid credentials, OTP, session, cookie, source IP, or device association is required.

Which accounts are at risk during an active grace window?

Any WordPress account with an active Delay OTP grace window can be impersonated, including administrator accounts. The grace-state user_meta value is keyed only to the target user ID, so it is not tied to the legitimate user's originating session or device.

What can be changed if updating is not immediately possible?

Disable Delay OTP Verification or stop using the specified OTP-only login configuration. The described attack requires both features to be enabled simultaneously.

CVE-2026-103895: miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit it?

Which accounts are at risk during an active grace window?

What can be changed if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit it?

Which accounts are at risk during an active grace window?

What can be changed if updating is not immediately possible?