External risk intelligence

WordPress miniOrange 2FA Plugin Allows Unauthenticated Deletion of Site Options

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-77770

This vulnerability affects a WordPress plugin. WordPress sites are commonly deployed as public-facing web applications, and the vulnerable functionality is reachable via unauthenticated requests over the network, making the attack surface readily accessible to internet traffic.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security flaw in the miniOrange 2FA WordPress plugin allows unauthenticated users to delete critical site settings, potentially locking administrators out or disabling the plugin. The issue is accessible over the network and could impact the availability of WordPress sites. The main concern is confirming relevance and exposure.

Unauthenticated users can delete important site settings.
This can lock administrators out of their websites.
Confirm if your WordPress sites are affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a request to a WordPress site that uses the miniOrange 2FA plugin. Because the plugin does not properly check if a request is legitimate before deleting site settings, any visitor can trigger the deletion of arbitrary options. This can lead to administrators being locked out of their dashboards or the plugin being deactivated.

Unauthenticated network access required.
Unvalidated request input deletes site options.
Arbitrary option deletion causes lockout.

Live Threat

Current exploitation, exposure, and threat context

A visitor could remove site options without authentication, potentially locking administrators out of the WordPress dashboard or deactivating the 2FA plugin when supported.

WordPress site options.
Unauthenticated HTTP requests.
Administrator lockout or plugin deactivation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the miniOrange 2FA WordPress plugin impacts any public-facing website using the plugin. The immediate priority for system owners and security teams is to identify all WordPress instances, confirm their exposure, and determine accountability for the affected plugin before planning remediation.

WordPress site owners/administrators should own.
Verify plugin reachability and critical business impact.
Plan remediation during a scheduled maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the miniOrange 2FA WordPress plugin?

The miniOrange 2FA plugin is an extension for WordPress sites that adds a layer of security by requiring a second form of identity verification, such as a code or app approval, during login. It is commonly used by administrators to protect their site dashboards from unauthorized access. This CVE specifically impacts versions of this plugin that do not properly verify administrative requests.

What does CWE-862 mean for CVE-2026-77770?

CWE-862 refers to Missing Authorization. In the context of this vulnerability, it means the plugin fails to check if a person is authorized to perform a specific action—in this case, deleting site settings. Because this check is missing, the software assumes any request it receives is valid, allowing someone to remove critical configurations without proving they have administrative permissions.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted, unauthenticated request directly to the website over the network. They do not need an existing account or password to initiate this. It is important to note that merely visiting the site's public pages in a standard web browser does not trigger this; the attacker must intentionally send a request that specifically targets the vulnerable site option deletion functionality.

Is my site at risk?

According to Halo Surface Signal, this vulnerability is likely relevant to your site if you use the affected plugin, as WordPress sites are typically internet-facing web applications. Since the flaw allows unauthenticated network access to delete site options, any instance exposed to the public internet is considered reachable. You should check if your site environment meets these criteria.

What should I do if I use this plugin?

First, verify which version of the miniOrange 2FA plugin is currently installed on your WordPress instances. Once identified, evaluate the impact on your site's availability and administrative access. Coordinate with your team to plan for updates or configuration changes during a scheduled maintenance window to ensure your security settings and dashboard remain fully functional.

References

wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.