high7.5
CVE-2026-111949
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has…
Impact
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
Affected products
| Product | Affected versions |
|---|---|
| MiniOrange 2FA WordPress Plugin | before 6.3.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.