WordPress plugin · miniorange-2-factor-authentication
Is miniOrange 2FA safe?
Safe on 6.5.0 or newer.
The current version, 6.5.0, is past every affected range on record (11 of 11 records list one). Keep it updated and you’re clear of them.
- Flaws on record
- 11
- High or critical
- 7
- Exploited
- none
- Current version
- 6.5.0
- Last updated
- Oct 21, 2026
- Active installs
- 10,000+
Every recorded flaw
- Oct 21, 2026miniOrange 2FA: Does not prevent a pending passkey login from registering an additional passkey on an account that already has one configuredCVE-2026-111949 · fixed in 6.3.1 · reported by WPScanHigh 7.5
- Aug 6, 2026miniOrange 2FA: Does not correctly limit the number of second-factor verification attemptsCVE-2026-16619 · fixed in 6.2.8 · reported by WPScanHigh 7.5
- Aug 5, 2026miniOrange 2FA: Does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factorCVE-2026-16036 · fixed in 6.2.7 · reported by WPScanHigh 7.5
- Aug 4, 2026miniOrange 2FA: Does not restrict who can trigger its second-factor configuration OTP sendCVE-2026-16035 · fixed in 6.2.7 · reported by WPScanMedium 4.3
- Jul 31, 2026miniOrange 2FA: Does not validate the submitted one-time password against the targeted user's stored secretCVE-2026-12695 · fixed in 6.2.6 · reported by WPScanHigh 8.1
- Dec 18, 2025miniOrange's Google Authenticator: Missing AuthorizationCVE-2025-54745 · affects up to 6.1.1 · reported by PatchstackMedium 6.5
- Dec 29, 2023Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication –CVE-2022-44589 · affects up to 5.6.1 · reported by PatchstackHigh 8.1
- Oct 20, 2023miniOrange's Google Authenticator: Authorization bypassCVE-2022-4943 · affects up to 5.6.5 · reported by WordfenceHigh 7.5
- Nov 18, 2022Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.CVE-2022-42461 · affects up to 5.6.1 · reported by PatchstackMedium 5.4
- Jun 27, 2022miniOrange's Google Authenticator: Does not sanitise and escape some of its settingsCVE-2022-1321 · fixed in 5.5.6 · reported by WPScanMedium 4.8
- Mar 21, 2022miniOrange's Google Authenticator: Does not have proper authorisation and CSRF checksCVE-2022-0229 · fixed in 5.5 · reported by WPScanHigh 8.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.