CVE-2026-103895: miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State
The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the mobypasslogin() function. This is due to modelayotpprocess() short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (movlastverifieddttm) being stored as a usermeta row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the mowploginintent=otp parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (wploginskippassword=1, wploginskippasswordfallback=0) and Delay OTP Verification (wplogindelayotp=1) enabled, and the target account must currently be within its configured Delay OTP interval.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this bypass?
Exposure requires both OTP-only login to be enabled (wp_login_skip_password=1 and wp_login_skip_password_fallback=0) and Delay OTP Verification to be enabled (wp_login_delay_otp=1). The affected account must also be inside its configured Delay OTP grace interval.
What does an attacker need to exploit it?
An attacker needs only a known WordPress username, the mo_wp_login_intent=otp parameter, and any non-empty password. No valid credentials, OTP, session, cookie, source IP, or device association is required.
Which accounts are at risk during an active grace window?
Any WordPress account with an active Delay OTP grace window can be impersonated, including administrator accounts. The grace-state user_meta value is keyed only to the target user ID, so it is not tied to the legitimate user's originating session or device.
What can be changed if updating is not immediately possible?
Disable Delay OTP Verification or stop using the specified OTP-only login configuration. The described attack requires both features to be enabled simultaneously.