Attack Chain

1. An unauthenticated attacker identifies a WordPress site running the vulnerable miniOrange OTP Login, Verification and SMS Notifications plugin (versions <= 5.5.1) with the Ultimate Member Password Reset Form integration active.
2. The attacker navigates to the Ultimate Member password reset page, where the plugin publicly emits a form_nonce via the moumprvar JavaScript object. The attacker extracts this nonce value.
3. The attacker crafts a malicious HTTP request (likely a POST request) to the server-side password reset handler (e.g., associated with the um_reset_password_process_hook() function).
4. This request includes the extracted form_nonce and an attacker-chosen username_b parameter, targeting an existing Administrator account on the WordPress site.
5. Due to the vulnerability, the server processes the request without validating whether the OTP verification step was successfully completed for the targeted user.
6. The server responds with an HTTP 302 redirect, providing a freshly generated password-reset URL in the Location header for the specified Administrator account.
7. The attacker uses this URL to set a new password for the Administrator account, thereby gaining full administrative control over the WordPress site.

Impact

The impact of CVE-2026-14245 is severe, as it allows any unauthenticated attacker to gain full administrative control over a vulnerable WordPress site. This can lead to complete compromise of the website, including data exfiltration, website defacement, injection of malicious content, establishment of persistent backdoors, and use of the site for further attacks (e.g., phishing or malware distribution). The vulnerability, with a CVSS v3.1 Base Score of 9.8 (Critical), signifies a high likelihood of successful exploitation with devastating consequences for the affected organization, impacting website integrity, data confidentiality, and availability.

Recommendation

• Immediately update the miniOrange OTP Login, Verification and SMS Notifications plugin to a patched version beyond 5.5.1 to address CVE-2026-14245.
• Review the configuration of the miniOrange OTP plugin to ensure it is not configured for phone-only reset if other reset methods are intended to be secured.
• Audit WordPress user accounts, especially Administrator accounts, for any unauthorized password changes or suspicious activity that may indicate prior exploitation of CVE-2026-14245.