Description

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-26T18:16:31.010Z",
  "pubdate": "2026-09-26T18:16:31.010Z",
  "executiveSummary": "The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (versions 5.5.5 and below) contains a critical authentication bypass vulnerability.\nThe flaw allows unauthenticated remote attackers to assume the identity of any administrator account by manipulating specific POST parameters.\nThe vulnerability stems from a logical failure in the mo_by_pass_login() function, where the security guard responsible for validating passwords is bypassed if the 'mo_wp_login_intent' parameter is set to 'otp'.\nExploitation is possible when specific, common administrative settings are active, specifically: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.\nAn attacker does not require a password or valid One-Time Password (OTP) to gain access. Successful exploitation results in complete site takeover with administrative privileges.\nGiven the severity and the ease of exploitation (which requires only a known administrator username), this vulnerability presents a high risk to all WordPress installations utilizing the affected plugin configuration.",
  "technicalDetails": "The vulnerability exists within the mo_by_pass_login() function of the miniOrange OTP Login, Verification and SMS Notifications plugin. The root cause is a flawed logical branch when the 'skip_pass_fallback' configuration is enabled, paired with the 'Admin OTP Bypass' setting.\nWhen an attacker sends a POST request to the WordPress login endpoint containing the parameter 'mo_wp_login_intent=otp', the plugin's internal authentication logic is diverted. Under normal conditions, the system should trigger wp_authenticate_username_password() to verify the integrity of the credentials. However, the presence of the 'otp' parameter triggers an insecure resolution path.\nThe vulnerable code path utilizes mo_get_user() to identify the user object. Because the logic assumes that the 'Admin OTP Bypass' enabled state implies implicit trust, it fails to verify that the requestor actually possesses the credentials or the required OTP associated with the target account. Instead, it relies solely on the provided username to resolve a WP_User instance.\nAttack Flow: 1. The attacker identifies an administrator's username (e.g., 'admin'). 2. The attacker crafts an HTTP POST request to the login interface. 3. The attacker injects the parameter 'mo_wp_login_intent=otp' into the request body while leaving the password field empty or arbitrary. 4. The server-side application processes the request, hits the vulnerable branch in mo_by_pass_login(), and skips the standard WordPress password verification layer. 5. The application returns an active session for the target administrator account.\nThis authentication bypass effectively nullifies the entire security model of the plugin's login flow. Because the authentication process is entirely bypassed, there is no requirement for valid MFA (OTP) or password knowledge. Once the session is established, the attacker gains full administrative access to the WordPress environment, allowing for remote code execution (via plugin/theme uploads), database manipulation, or user account modification.\nAffected versions are all iterations up to and including 5.5.5. The vulnerability is entirely server-side and reachable via any web-facing WordPress login page where the aforementioned settings are enabled. No complex payload construction is required, as the exploit relies on exploiting the intended logic of the 'Admin OTP Bypass' feature rather than memory corruption or injection techniques."
}