Authentication Bypass in miniOrange OTP Login Plugin

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress contains an authentication bypass vulnerability, assigned CVE-2026-103895, affecting all versions up to and including 5.5.8. The flaw resides in the mo_by_pass_login() function. The vulnerability stems from the improper handling of the Delay OTP grace flag (mov_last_verified_dttm), which is stored in the WordPress user_meta table keyed only by user ID. This metadata lacks binding to specific session tokens, IP addresses, or device identifiers.

When a site is configured with OTP-only login (wp_login_skip_password=1) and Delay OTP Verification (wp_login_delay_otp=1), an attacker can trigger the mo_delay_otp_process() function to short-circuit the standard authentication workflow. By submitting a target username along with the mo_wp_login_intent=otp parameter and an arbitrary password, an attacker can inherit an existing user's grace period window, effectively logging in as that user without valid credentials. This impacts any user account, including administrators, provided they fall within the configured delay interval.

Impact

Successful exploitation allows unauthenticated attackers to achieve full account takeover of any WordPress user on the target site. Given the plugin's potential to affect administrator accounts, this vulnerability can lead to complete site compromise, including the execution of arbitrary code via administrative plugin or theme management, configuration changes, and data exfiltration.

Recommendation

• Update the miniOrange OTP Login, Verification and SMS Notifications plugin to version 5.5.9 or later immediately to resolve CVE-2026-103895.
• Monitor web server access logs for HTTP POST requests directed at the WordPress login interface containing the parameter mo_wp_login_intent=otp.
• Disable wp_login_skip_password and wp_login_delay_otp settings in the plugin configuration as a temporary mitigation until the software is patched.