miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 - 6.3.0 - Two-Factor Authentication Bypass

The miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions 6.2.9 through 6.3.0. This is due to missing check on whether the requesting session is a fully authenticated dashboard session before allowing passkey registration on accounts that already have 2FA configured, allowing a mid-login (pending) session to add a new passkey. This makes it possible for authenticated attackers, with subscriber-level access and above, to add their own passkey authenticator to a victim account during a pending login session, then complete authentication as that user without possessing the legitimate second factor. The attacker must know the target user's password, and the target account must have a passkey already configured as the second factor.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: miniOrange 2FA 6.3.1 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts