Description

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "10.0",
  "pubDate": "2026-09-10T07:17:02.943Z",
  "pubdate": "2026-09-10T07:17:02.943Z",
  "executiveSummary": "The miniOrange 2FA WordPress plugin is susceptible to an unauthenticated arbitrary option deletion vulnerability.\nThe vulnerability stems from the absence of proper authorization checks and transaction validation when processing requests to modify or delete site-specific options.\nThis flaw allows any unauthenticated visitor to remove critical WordPress site options by injecting malicious request input.\nThe potential impact is severe, enabling attackers to lock all administrators out of the dashboard or force the deactivation of the miniOrange 2FA security features.\nThe issue affects versions of the miniOrange 2FA plugin prior to 6.3.1 and 19.3.\nBecause no authentication is required, the exploitation path is accessible over the network to any remote attacker, posing a high risk to the availability and security configuration of the affected WordPress site.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation and the omission of security nonces or capability checks within the plugin's administrative option management handlers.\nWordPress site options are typically stored in the 'wp_options' table. Plugins often provide functionality to update or delete these options, which requires strict privilege enforcement.\nIn this instance, the plugin fails to ensure that the request originated from an authorized administrator. An attacker can supply arbitrary option keys via unauthenticated HTTP request parameters.\nThe vulnerable code executes the deletion logic without verifying the user's session or permissions, allowing the attacker to influence which record is purged from the database.\nAttack flow: An unauthenticated attacker sends a specially crafted POST or GET request to the vulnerable endpoint exposed by the miniOrange 2FA plugin. The request payload identifies the target option key that the plugin is configured to process.\nBecause the plugin does not validate the transaction against a valid security token (nonce) or check the current user's role, the server-side code proceeds to call the WordPress native function responsible for deleting the option.\nImpact includes the ability to remove vital configuration settings. By deleting core options, an attacker can effectively disrupt the site's functionality. For example, clearing configuration values associated with the authentication plugin results in its immediate deactivation, bypassing any active 2FA protections.\nFurthermore, deleting specific internal WordPress settings or authentication keys can prevent administrators from successfully logging in to the dashboard, resulting in a self-inflicted Denial of Service (DoS) triggered by the attacker.\nThe vulnerability is persistent in nature and does not require complex prerequisites, such as specific database states or pre-existing user sessions, making it highly exploitable for malicious actors scanning for accessible plugin endpoints.\nAffected versions specifically include those prior to 6.3.1 and 19.3. The lack of an access control layer ensures that any request reaching the plugin handler is processed with the authority of the web server service account, granting the attacker excessive capability over the site's option management."
}