CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.
Explanation of Vulnerability in Simple Terms
The miniOrange Google Authenticator plugin for WordPress exposes sensitive information through improper access controls. An attacker can retrieve authentication data and user credentials without authentication. This affects all versions up to 5.6.1. Site administrators should update immediately to a patched version.
What an attacker can do
Read user authentication tokens, credentials, and sensitive plugin configuration data without logging in.
Potential impact on your site
User accounts and two-factor authentication credentials may be compromised; attackers can bypass login security.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
