{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/otp-login-verification-and-sms-notifications--5.5.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:miniorange:otp_login_verification_and_sms_notifications:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-103895"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OTP Login, Verification and SMS Notifications (\u003c= 5.5.8)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","authentication-bypass","cve-2026-103895"],"_cs_type":"advisory","_cs_vendors":["miniOrange"],"content_html":"\u003cp\u003eThe miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress contains an authentication bypass vulnerability, assigned CVE-2026-103895, affecting all versions up to and including 5.5.8. The flaw resides in the \u003ccode\u003emo_by_pass_login()\u003c/code\u003e function. The vulnerability stems from the improper handling of the Delay OTP grace flag (\u003ccode\u003emov_last_verified_dttm\u003c/code\u003e), which is stored in the WordPress \u003ccode\u003euser_meta\u003c/code\u003e table keyed only by user ID. This metadata lacks binding to specific session tokens, IP addresses, or device identifiers.\u003c/p\u003e\n\u003cp\u003eWhen a site is configured with OTP-only login (\u003ccode\u003ewp_login_skip_password=1\u003c/code\u003e) and Delay OTP Verification (\u003ccode\u003ewp_login_delay_otp=1\u003c/code\u003e), an attacker can trigger the \u003ccode\u003emo_delay_otp_process()\u003c/code\u003e function to short-circuit the standard authentication workflow. By submitting a target username along with the \u003ccode\u003emo_wp_login_intent=otp\u003c/code\u003e parameter and an arbitrary password, an attacker can inherit an existing user's grace period window, effectively logging in as that user without valid credentials. This impacts any user account, including administrators, provided they fall within the configured delay interval.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to achieve full account takeover of any WordPress user on the target site. Given the plugin's potential to affect administrator accounts, this vulnerability can lead to complete site compromise, including the execution of arbitrary code via administrative plugin or theme management, configuration changes, and data exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the miniOrange OTP Login, Verification and SMS Notifications plugin to version 5.5.9 or later immediately to resolve CVE-2026-103895.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for HTTP POST requests directed at the WordPress login interface containing the parameter \u003ccode\u003emo_wp_login_intent=otp\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eDisable \u003ccode\u003ewp_login_skip_password\u003c/code\u003e and \u003ccode\u003ewp_login_delay_otp\u003c/code\u003e settings in the plugin configuration as a temporary mitigation until the software is patched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:25:14Z","date_published":"2026-10-16T06:25:14Z","id":"https://feed.craftedsignal.io/briefs/2026-10-miniorange-otp-bypass/","summary":"An authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress allows unauthenticated attackers to hijack user sessions.","title":"Authentication Bypass in miniOrange OTP Login Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-miniorange-otp-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - OTP Login, Verification and SMS Notifications (\u003c= 5.5.8)","version":"https://jsonfeed.org/version/1.1"}