miniOrange OTP Login, Verification and SMS Notifications
miniOrange OTP Login, Verification and SMS Notifications has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 8 are fixed as of October 2026. Their average CVSS score is 8.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 4 critical and 3 high. 2026 was the busiest year with 7 disclosures.
The most common weakness is Improper Authentication, behind 2 of the records (25%). Other recurring categories include Incorrect Privilege Assignment, Missing Authorization.
Every one of the 8 issues recorded for miniOrange OTP Login, Verification and SMS Notifications has a vendor fix available, so running the current release closes all known holes.
8 independent researchers contributed these findings, one record each. miniOrange OTP Login, Verification and SMS Notifications is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-85984miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter
Read the full analysisVulnerability Records

miniOrange OTP Login, Verification and SMS Notifications
Author
miniOrange
The WordPress OTP Verification plugin verifies users’ email IDs and mobile numbers through an OTP (One-Time Password) sent via SMS, email or WhatsApp during registration, login, and contact form submissions. This ensures that only genuine users can sign up while preventing fake registrations, spam sign-ups and duplicate accounts. Add mobile number verification, phone number login, passwordless OTP login, WhatsApp OTP and WooCommerce SMS notifications to your site, with support for WooCommerce (classic and block checkout), Elementor Pro, Contact Form 7, WPForms, Gravity Forms, Ultimate Member, BuddyPress and 30+ other forms. Note: Enjoy 10 free email and SMS OTPs upon installation to experience the plugin’s functionality. Quick Links Official Website | Setup Guide | Documentation | Contact Us Popular use cases Verify mobile numbers and email addresses at registration using SMS OTP or Email OTP Login with phone number and OTP — passwordless login for WordPress and WooCommerce WooCommerce checkout OTP verification on classic and block checkout Send WooCommerce order status SMS and WhatsApp notifications to buyers, sellers, admins and vendors Reset passwords using OTP instead of email links for WooCommerce and Ultimate Member Stop fake registrations, spam sign-ups and duplicate accounts by blocking email domains and phone numbers and limiting OTP requests Use Twilio, Msg91, Plivo, AWS SNS, ClickSend, Clickatell or any custom SMS gateway Watch this video to learn more about the OTP Verification plugin and its capabilities: FEATURES OF OTP VERIFICATION & ONE-TIME PASSWORD LOGIN PLUGIN OTP Verification on 30+ forms including WooCommerce, Elementor Pro, Contact Form 7, WPForms & Gravity Forms miniOrange SMS gateway support Login with Phone Number using OTP Register with Phone Number WooCommerce SMS Notifications for Order Status Updates OTP Spam Preventer/Limit OTP Addon Allow OTP for selected countries Ultimate Member SMS Notification Ultimate Member Password Reset Detailed Transaction Reports and Logs Passwordless Login using OTP Verification Country code dropdown and phone number validation Customize OTP length and validity Masked phone number and email address on the frontend for user privacy Block specific email domains and phone numbers to stop fake registrations and spam sign-ups OTP pop-up customization (available on limited login, registration, and checkout forms) Test Mode to test OTP flows without sending real OTPs or consuming credits Translation-ready — compatible with WPML & PolyLang for multilingual sites AI-Ready — WordPress Abilities API integration to send/verify OTPs and manage plugin settings via AI agents & MCP-compatible tools PREMIUM FEATURES AVAILABLE ON UPGRADE WhatsApp OTP Verification / OTP Over WhatsApp Both Email and Phone Verification Custom SMS & Email Gateways Register Using Phone Number Addon WCFM Vendor SMS Notifications Dokan Vendor SMS Notifications Elementor Pro Forms Checkout WC Form Jet Engine Form JetFormBuilder Form by Crocoblock WS Pro Contact Form Tutor LMS Instructor Registration Form Tutor LMS Login Form Tutor LMS Student Registration Form User Registration Forms — WP Everest WooCommerce Frontend Manager Form (WCFM) Houzez — Real Estate Theme Login using phone number Addon Autofill OTP on Phone (auto-read OTP from SMS) Numeric or Alphanumeric OTP Format OTP Verification on Selected WooCommerce Product Category Geolocation/IP based Country Code Dropdown WordPress Registration SMS Notification to Admin & User Master OTP for admin/testing verification Backup SMS Gateway (automatic failover) WooCommerce Low Stock & Out of Stock Notifications miniOrange SMTP support for Email OTP Globally Banned Phone Number (block numbers across your account) Import/Export plugin configuration and settings Customize specific SMS and Email templates THIRD PARTY CUSTOM SMS GATEWAY FOR OTP Verification and SMS Notifications In the OTP Verification Plugin, you can use your third-party SMS gateway for sending the SMS/Email OTP & SMS Notifications. You can also use the miniOrange gateway to perform OTP verification over Phone/SMS and Email or to send SMS notifications. We support OTP Verification worldwide. Some of the well-known Gateways supported for OTP and SMS (OTP): — Twilio — Clickatell — ClickSend — SendGrid — Plivo — AWS SNS — Msg91 Check the list of a few of our supported SMS gateways here: SMS Gateways WHATSAPP OTP VERIFICATION & NOTIFICATIONS In our OTP Plugin, you can enable OTP Verification via WhatsApp as well as send custom messages & order notifications on WhatsApp. Enables WooCommerce order status notifications, new account SMS notifications, and many more on WhatsApp. Contact us at otpsupport@xecurify.com/info@xecurify.com to know more. AI-READY: WORDPRESS ABILITIES API & MCP INTEGRATION The OTP Verification plugin integrates with the WordPress Abilities API, exposing plugin actions as AI-ready abilities that can be invoked by AI agents and MCP-compatible tools. This lets you automate and manage OTP Verification using natural language through your AI assistant, including: * Send, verify, and resend OTPs programmatically * Enable/disable and configure supported forms * Configure SMS/Email gateways and WhatsApp settings * View transaction reports, logs, and remaining transactions * Manage blocklists, country restrictions, and rate-limit/spam settings * Manage account, run diagnostics, and update OTP settings FREE AND PREMIUM OTP VERIFICATION ADDONS SUPPORTED Follow the link to check free and premium addons supported in the OTP Verification plugin : OTP Verification Addons Supported Login with Phone Number:The login with Phone add-on allows users to log in using a phone number only. WooCommerce SMS Notifications:Allows your site to send automated WooCommerce order notifications and WooCommerce sms notifications to buyers, sellers, and admins. Both buyers and sellers can get SMS notifications after an order is placed or when the order status changes. Passwordless Login:With Passwordless login, users would be able to log in using their Username and OTP. Register Using Phone Number Only:: Users can register on your WordPress site using only a Phone Number and OTP instead of an Email address or Username. WooCommerce Password Reset:Addon replaces the existing WooCommerce Password reset functionality with OTP Verification. Allows users to reset their password using OTP Verification instead of email links. Ultimate Member SMS NotificationsAllows your site to send automated Ultimate Member notifications to admins and users. Ultimate Member Password Reset:Add-on that replaces the existing Ultimate Member Password reset functionality with OTP Verification. Allows users to reset their passwords using OTP Verification instead of email links. Country Restriction Add-on:Add-on allows OTP Verification to be enabled for a selected list of countries only. OTP Verification for any other country outside the selected list will be blocked by the add-on. OTP Over Phone Call:Add-on allows OTP Verification over a Phone Call instead of SMS. The code will be received via a phone call to the customer. Updated List Of Supported Forms Supported WordPress Forms WordPress Login Form Elementor Pro Forms WordPress default registration/TML Registration Form WooCommerce Login Form WooCommerce Registration Form WooCommerce Checkout Form WooCommerce FrontEnd Manager Form(WCFM) WooCommerce Billing Address Form Ultimate Member Registration Form Ultimate Member Profile/Accounts Page Ultimate Member Login Form Ultimate Member Password Reset Form Gravity Forms Form Maker Form User Registration Form — WP Everest WooCommerce Social Login form ARMember Registration Form Profile Builder Registration Form Simplr Registration Form BuddyPress / BuddyBoss Registration Form RegistrationMagic / User Registration Form Builder Users Ultra Registration form User Profiles Made Easy Registration Form Checkout WC PIE Registration Form Contact Form 7 Ninja Forms Above version 3.0 Theme My Login Gravity Forms WP-Members Indeed Ultimate Membership Pro Classify Theme Registration Real estate 7 pro Theme WP eMember Form FormCraft Basic — Free Version FormCraft — Premium Version WordPress Comment Form DocDirect Theme WpForms Caldera Forms MemberPress Registration Paid Membership Pro Real Estate 7 Pro WooCommerce Product Vendor Registration Form Formidable Form Visual Form Builder Eduma Login Form Eduma Theme Registration Form UserPro Plugin WS Pro Contact form JetFormBuilder by Crocoblock Everest Contact Form Fluent Form Fluent Conversational Form Forminator Form Dokan Registration Form WooCommerce Account Details Form miniOrange Login/Register with Phone Form Easy Registration Forms Houzez Theme Registration Jet Engine miniOrange Social Login WP User Manager Registration Form Real Estate WP Theme Registration Form WP Client Registration Form MemberPress Single Checkout Registration Form MultiSite Registration Form How does this plugin work? On submitting the registration/login form, an Email/SMS with OTP is sent to the email address/mobile number provided by the user. Once the OTP is entered, it is verified, and the user gets registered/logs in. External Services and Libraries This plugin uses the miniOrange Servers for OTP Validation. intlTelInput – The plugin uses the intlTelInput library for international telephone input formatting and validation. The minified files intlTelInput.min.js and intlTelInput.min.css are included in the plugin distribution. The source code for intlTelInput is available at: intlTelInput GitHub repository SUPPORT Customized solutions and Support options are available. Email us at otpsupport@xecurify.com/info@xecurify.com.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C