---
id: CVE-2026-103895
title: >-
  The miniOrange OTP Login, Verification and SMS Notifications plugin for
  WordPress is vulnerable to Authentication Bypass in versions up to, and
  including, 5.5.8 via the `mo_by_pass_login()` function
summary: >-
  The miniOrange OTP Login, Verification and SMS Notifications plugin for
  WordPress is vulnerable to Authentication Bypass in versions up to, and
  including, 5.5.8 via the `mo_by_pass_login()` function. This is due to
  `mo_delay_otp_process(…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
vendor: cyberlord92
product: 'miniOrange OTP Login, Verification and SMS Notifications'
affected:
  - miniorange_otp_login_verification_and_sms_notifications <= 5.5.8
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T16:16:54.177'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103895'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1050
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1170
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1519
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L1573
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.7/handler/forms/class-wploginform.php#L511
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification?rev=3741261
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3733803/miniorange-otp-verification/trunk/handler/forms/class-wploginform.php
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/4a3a7097-e184-40d0-9c26-7c5638c937a5?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
epss: 0.00427
epssPercentile: 0.36758
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:45:26.474671Z'
ingestedAt: '2026-10-16T04:58:47.495Z'
---

## Overview

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the `mo_wp_login_intent=otp` parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login (`wp_login_skip_password=1`, `wp_login_skip_password_fallback=0`) and Delay OTP Verification (`wp_login_delay_otp=1`) enabled, and the target account must currently be within its configured Delay OTP interval.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.