Authentication Bypass in miniOrange OTP Login Plugin

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress (all versions up to and including 5.5.5) contains a critical authentication bypass vulnerability identified as CVE-2026-85984. The flaw resides within the mo_by_pass_login() function, where improper handling of the mo_wp_login_intent POST parameter allows an authentication bypass when specific administrative configurations are active. If a site administrator has enabled 'WP Login OTP', 'Login with Only OTP', 'Allow Users to Login with Username and Password', and 'Admin OTP Bypass', the system fails to validate credentials. An attacker simply provides a valid administrative username and the parameter mo_wp_login_intent=otp. The plugin erroneously skips the standard wp_authenticate_username_password() check and resolves the WP_User account solely based on the username, granting full access without a password or OTP verification. This vulnerability poses a severe risk to WordPress instances configured with these specific security settings.

Impact

Successful exploitation allows an unauthenticated attacker to gain full administrative access to the affected WordPress site. This provides the attacker with complete control over the site content, user management, and plugin configuration, which could lead to further compromise through malicious plugin uploads, data exfiltration, or complete site takeover.

Recommendation

Prioritize the immediate update of the miniOrange OTP Login, Verification and SMS Notifications plugin to a version beyond 5.5.5. If patching is not immediately feasible, disable the 'Admin OTP Bypass' option within the plugin settings to mitigate the primary vector for this bypass. Review administrative account login logs for suspicious activity occurring without standard password-based authentication steps.