CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
Explanation of Vulnerability in Simple Terms
miniOrange 2FA versions before 6.2.8 contain a vulnerability allowing authenticated users with low privileges to read sensitive data, modify site content, or disrupt service. The attack requires network access and some technical complexity but does not require user interaction. Administrators should update to version 6.2.8 or later immediately.
What an attacker can do
Read sensitive data, modify site content, or disrupt service availability.
Potential impact on your site
Authenticated users can access confidential information, alter content, or cause downtime.
Conditions required to exploit
Attacker must have low-level user account; network access required.
Key dates
External resources
