External risk intelligence

WordPress miniOrange OTP Plugin Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-85984

The vulnerability exists in a WordPress authentication plugin that modifies the standard login process. Because WordPress login pages are publicly accessible web endpoints by design, and this plugin is intended to handle user authentication, the vulnerable code path is commonly exposed to the public internet in standard website deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in a WordPress plugin that handles login and SMS notifications. The issue allows unauthenticated attackers to bypass standard login procedures and access any administrator account by exploiting specific plugin settings. While exploitation requires a precise, conditional configuration, the potential for unauthorized access to administrative functions is significant.

Plugin bypass allows unauthorized admin access.
Critical access risk requires immediate attention.
Verify configuration and plugin relevance.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on a WordPress site by exploiting a flaw in the miniOrange OTP Login plugin. This occurs when specific plugin settings are enabled, allowing an unauthenticated attacker to provide a username and an empty password along with a crafted parameter to log in as an administrator without needing the actual password or a one-time code.

Entry condition: Specific plugin settings enabled.
Trigger point: Sending crafted login request parameters.
Resulting risk: Administrator account takeover.

Live Threat

Current exploitation, exposure, and threat context

When specific plugin options are enabled, unauthenticated attackers could bypass WordPress administrator login by providing only a username and an empty password. This could allow unauthorized access to administrator accounts on affected WordPress sites.

Administrator account access.
Bypass authentication with known username.
Unauthorized site control and modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress requires specific plugin settings to be enabled. Technical leaders should first confirm if these settings are active on their WordPress instances, identify which instances are externally accessible, and determine the business criticality of those instances. Collaboration between application owners, infrastructure teams, and potentially vendor management will be necessary to assess risk and plan remediation.

Determine if critical plugin settings are enabled.
Verify external reachability and business impact.
Coordinate with application and vendor teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the miniOrange OTP Login, Verification and SMS Notifications plugin?

This is a WordPress plugin designed to add security layers, such as one-time passwords (OTP) and SMS-based alerts, to the standard WordPress user login process. It allows site administrators to move beyond basic password-only authentication for their users and site members.

What does CWE-287 mean for CVE-2026-85984?

CWE-287 refers to Improper Authentication. In the context of this vulnerability, it means the plugin fails to correctly verify the identity of a person logging in. Specifically, the software incorrectly assumes that certain administrative conditions have been met, allowing an attacker to gain access without actually providing a valid password or the required one-time code.

How can an attacker trigger this authentication bypass?

An attacker must send a crafted request to the site containing a specific username and an empty password, accompanied by a manipulated parameter. This vulnerability does not trigger under standard configurations; it only occurs if the administrator has enabled a very specific combination of settings, including 'Admin OTP Bypass' and other related login options.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal notes that since this plugin modifies WordPress login pages—which are inherently accessible to the public internet—sites running the vulnerable configuration are highly exposed. Because the login endpoint is typically public, the potential for unauthorized administrative access exists for any site where the specific, vulnerable combination of plugin settings is active.

Do I need to take action if I use this plugin?

First, verify if your WordPress instance has the specific combination of OTP and Admin Bypass settings enabled. If you find these settings active, prioritize reviewing your plugin version and configuration. If you cannot immediately verify or disable these settings, consider restricting access to the login page or consulting the plugin developer for the latest secure version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.