miniOrange OTP Login, Verification and SMS Notifications
miniOrange OTP Login, Verification and SMS Notifications has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 8.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 1 high. 2026 was the busiest year with 4 disclosures.
The most common weakness is Incorrect Privilege Assignment, behind 2 of the records (40%). Other recurring categories include Missing Authorization, Cross-Site Scripting.
Every one of the 5 issues recorded for miniOrange OTP Login, Verification and SMS Notifications has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, one record each. miniOrange OTP Login, Verification and SMS Notifications is installed on roughly 5,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-61967miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Unauthenticated Privilege Escalation
Read the full analysisVulnerability Records

miniOrange OTP Login, Verification and SMS Notifications
Author
miniOrange
Features | Setup Guide | Documentation | Contact Us The WordPress OTP Verification plugin verifies users’ email IDs and mobile numbers through an OTP (One-Time Password) sent during registration, login, and contact form submissions. This ensures that only genuine users can sign up while preventing fake registrations and duplicate accounts. Watch this video to learn more about the OTP Verification plugin and its capabilities: Enjoy 10 free email and SMS OTPs upon installation to experience the plugin’s functionality. FEATURES OF ONE-TIME PASSWORD PLUGIN OTP Verification On 30+ forms miniOrange SMS gateway support Login with Phone Number Register with Phone Number SMS Notifications for WooCommerce Order Status OTP Spam Preventor/Limit OTP Addon Allow OTP for selected countries Ultimate Member SMS Notification Ultimate Member Password Reset Detailed Transaction Reports and Logs Passwordless Login using OTP Verification Country code dropdown Customize OTP length and validity Masked phone number and email address on the frontend for user privacy Block specific email domains and phone numbers OTP pop-up customization (available on limited login, registration, and checkout forms) Translation ready — compatible with WPML & PolyLang for multilingual sites AI-Ready — WordPress Abilities API integration to send/verify OTPs and manage plugin settings via AI agents & MCP-compatible tools PREMIUM FEATURES AVAILABLE ON UPGRADE OTP Over WhatsApp Both Email and Phone Verification Custom SMS & Email Gateways Register Using phone number Addon WCFM Vendor SMS Notifications Dokan Vendor SMS Notifications Elementor Pro Forms Checkout WC Form Jet Engine Form JetFormBuilder Form by Crocoblock WS Pro Contact Form Tutor LMS Instructor Registration Form Tutor LMS Login Form Tutor LMS Student Registration Form User Registration Forms — WP Everest WooCommerce Frontend Manager Form (WCFM) Houzez — Real Estate Theme Login using phone number Addon Autofill OTP on Phone (auto-read OTP from SMS) Numeric or Alphanumeric OTP Format OTP Verification on Selected WooCommerce Product Category Geolocation/IP based Country Code Dropdown WordPress Registration SMS Notification to Admin & User Master OTP for admin/testing verification Back-Up SMS Gateway (automatic failover) WooCommerce Low Stock & Out of Stock Notifications miniOrange SMTP support for Email OTP Globally Banned Phone Number (block numbers across your account) Import/Export plugin configuration and settings Customize specific SMS and Email templates THIRD PARTY CUSTOM SMS GATEWAY FOR OTP Verification and SMS Notifications In the OTP Verification Plugin, you can use your third-party gateway for sending the SMS/Email & SMS Notifications. You can also use the miniOrange gateway to perform OTP verification over Phone/SMS and Email or to send SMS notifications. We support OTP Verification worldwide. Some of the well-known Gateways supported for OTP and SMS (OTP): — Twilio — Clickatell — ClickSend — SendGrid — Plivo — AWS SNS — Msg91 Check the list of a few of our supported SMS gateways here : SMS Gateways WHATSAPP OTP VERIFICATION & NOTIFICATIONS In our OTP Plugin, you can enable OTP Verification via WhatsApp as well as send custom messages & order notifications on WhatsApp. Enables order status notifications, new account sms notifications, and many more on WhatsApp. Contact us at otpsupport@xecurify.com/info@xecurify.com to know more. AI-READY: WORDPRESS ABILITIES API & MCP INTEGRATION The OTP Verification plugin integrates with the WordPress Abilities API, exposing plugin actions as AI-ready abilities that can be invoked by AI agents and MCP-compatible tools. This lets you automate and manage OTP Verification using natural language through your AI assistant, including: * Send, verify and resend OTPs programmatically * Enable/disable and configure supported forms * Configure SMS/Email gateways and WhatsApp settings * View transaction reports, logs and remaining transactions * Manage blocklists, country restrictions and rate-limit/spam settings * Manage account, run diagnostics and update OTP settings FREE AND PREMIUM OTP VERIFICATION ADDONS SUPPORTED Follow the link to check free and premium addons supported in the OTP Verification plugin : OTP Verification Addons Supported Login with Phone Number:The login with Phone add-on allows users to log in using a phone number only. WooCommerce SMS Notifications:Allows your site to send automated WooCommerce order notifications and WooCommerce sms notifications to buyers, sellers, and admins. Buyer and seller both can get SMS notifications after an order is placed or when the order status changes. Passwordless Login:With Passwordless login, users would be able to log in using their Username and OTP. Register Using Phone Number Only:: Users can register on your WordPress site using only a Phone Number and OTP instead of an Email address or Username. WooCommerce Password Reset:Addon replaces the existing WooCommerce Password reset functionality with OTP Verification. Allow users to reset their password using OTP Verification instead of email links. Ultimate Member SMS NotificationsAllows your site to send automated Ultimate Member notifications to admins and users. Ultimate Member Password Reset:Add-on that replaces the existing Ultimate Member Password reset functionality with OTP Verification. Allow users to reset their passwords using OTP Verification instead of email links. Country Restriction Addon:Add-on allows OTP Verification to be enabled for a selected list of countries only. OTP Verification for any other country outside the selected list will be blocked by the addon. OTP Over Phone Call:Add-on allows OTP Verification over a Phone Call instead of SMS. The code will be received via a phone call to the customer. Updated List Of Supported Forms Supported WordPress Forms WordPress Login Form Elementor Pro Forms WordPress default registration/TML Registration Form WooCommerce Login Form WooCommerce Registration Form WooCommerce Checkout Form WooCommerce FrontEnd Manager Form(WCFM) WooCommerce Billing Address Form Ultimate Member Registration Form Ultimate Member Profile/Accounts Page Ultimate Member Login Form Ultimate Member Password Reset Form Gravity Forms Form Maker Form User Registration Form — WP Everest WooCommerce Social Login form ARMember Registration Form Profile Builder Registration Form Simplr Registration Form BuddyPress / BuddyBoss Registration Form RegistrationMagic / User Registration Form Builder Users Ultra Registration form User Profiles Made Easy Registration Form Checkout WC PIE Registration Form Contact Form 7 Ninja Forms Above version 3.0 Theme My Login Gravity Forms WP-Members Indeed Ultimate Membership Pro Classify Theme Registration Real estate 7 pro Theme WP eMember Form FormCraft Basic — Free Version FormCraft — Premium Version WordPress Comment Form DocDirect Theme WpForms Caldera Forms MemberPress Registration Paid Membership Pro Real Estate 7 Pro WooCommerce Product Vendor Registration Form Formidable Form Visual Form Builder Eduma Login Form Eduma Theme Registration Form UserPro Plugin WS Pro Contact form JetFormBuilder by Crocoblock Everest Contact Form Fluent Form Fluent Conversational Form Forminator Form Dokan Registration Form WooCommerce Account Details Form miniOrange Login/Register with Phone Form Easy Registration Forms Houzez Theme Registration Jet Engine miniOrange Social Login WP User Manager Registration Form Real Estate WP Theme Registration Form WP Client Registration Form MemberPress Single Checkout Registration Form MultiSite Registration Form How does this plugin work? On submitting the registration/login form, an Email/SMS with OTP is sent to the email address/mobile number provided by the user. Once the OTP is entered, it is verified, and the user gets registered/logs in. External Services and Libraries This plugin uses the miniOrange Servers for OTP Validation. intlTelInput – The plugin uses the intlTelInput library for international telephone input formatting and validation. The minified files intlTelInput.min.js and intlTelInput.min.css are included in the plugin distribution. The source code for intlTelInput is available at: intlTelInput GitHub repository SUPPORT Customized solutions and Support options are available. Email us at otpsupport@xecurify.com/info@xecurify.com.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C