Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · miniorange-2-factor-authentication
miniOrange 2FA
11 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 21, 2026miniOrange 2FA: Does not prevent a pending passkey login from registering an additional passkey on an account that already has one configuredCVE-2026-111949 · fixed in 6.3.1 · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
Aug 6, 2026miniOrange 2FA: Does not correctly limit the number of second-factor verification attemptsCVE-2026-16619 · fixed in 6.2.8 · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code without limit and take over the account.
Aug 5, 2026miniOrange 2FA: Does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factorCVE-2026-16036 · fixed in 6.2.7 · reported by WPScanHigh 7.5
The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.
Aug 4, 2026miniOrange 2FA: Does not restrict who can trigger its second-factor configuration OTP sendCVE-2026-16035 · fixed in 6.2.7 · reported by WPScanMedium 4.3
The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the enrolling user's own address, allowing a low-privileged user to send one-time-passcode emails to arbitrary recipients and to exhaust the site's metered OTP allowance, preventing legitimate users from receiving their second-factor codes.
Jul 31, 2026miniOrange 2FA: Does not validate the submitted one-time password against the targeted user's stored secretCVE-2026-12695 · fixed in 6.2.6 · reported by WPScanHigh 8.1
The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access to the victim's account, including administrators.
Dec 18, 2025miniOrange's Google Authenticator: Missing AuthorizationCVE-2025-54745 · affects up to 6.1.1 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.
Dec 29, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication –CVE-2022-44589 · affects up to 5.6.1 · reported by PatchstackHigh 8.1
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1.
Oct 20, 2023miniOrange's Google Authenticator: Authorization bypassCVE-2022-4943 · affects up to 5.6.5 · reported by WordfenceHigh 7.5
The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings.
Nov 18, 2022Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-42461 · affects up to 5.6.1 · reported by PatchstackMedium 5.4
Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.
Jun 27, 2022miniOrange's Google Authenticator: Does not sanitise and escape some of its settingsCVE-2022-1321 · fixed in 5.5.6 · reported by WPScanMedium 4.8
The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup)
Mar 21, 2022miniOrange's Google Authenticator: Does not have proper authorisation and CSRF checksCVE-2022-0229 · fixed in 5.5 · reported by WPScanHigh 8.1
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.