Impact

Successful exploitation allows an unauthenticated attacker to gain full administrative access to the affected WordPress site. This provides the attacker with complete control over the site content, user management, and plugin configuration, which could lead to further compromise through malicious plugin uploads, data exfiltration, or complete site takeover.

Recommendation

Prioritize the immediate update of the miniOrange OTP Login, Verification and SMS Notifications plugin to a version beyond 5.5.5. If patching is not immediately feasible, disable the 'Admin OTP Bypass' option within the plugin settings to mitigate the primary vector for this bypass. Review administrative account login logs for suspicious activity occurring without standard password-based authentication steps.