miniOrange OTP auth bypass grants admin (CVE-2026-106610) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-106610 is a critical privilege escalation in miniOrange OTP Verification through 5.5.7 that grants unauthenticated attackers full administrative control of a WordPress site. No vendor patch has been confirmed for versions at or below 5.5.7, so sites running the plugin should treat this as urgent.

Overview

CVE-2026-106610 is an incorrect privilege assignment vulnerability in the miniOrange OTP Verification WordPress plugin, affecting all versions from the initial release through 5.5.7. The flaw lets an unauthenticated network attacker reach a code path that assigns elevated privileges without proving identity first. In practical terms, the plugin can be manipulated into treating a low-trust or anonymous request as if it came from a trusted, high-privilege user.

The CVSS score of 9.8 reflects the worst-case combination: the attack is reachable over the network, requires no credentials, needs no user interaction, and has low complexity. There is no special timing or race condition to exploit.

Impact

Successful exploitation results in full site compromise. An attacker who escalates to administrator can install malicious plugins or themes, create rogue admin accounts, exfiltrate the user database, inject persistent backdoors, and deface or redirect the site. Because OTP Verification is often deployed on sites handling logins, the same escalation path can expose customer records and authentication data. Any site running this plugin at 5.5.7 or earlier should assume it is exposed until proven otherwise.

Remediation and Mitigation

• Update the plugin to a version above 5.5.7 as soon as the vendor publishes a fixed release, and verify the changelog confirms the fix. If no patched version exists, deactivate and remove the plugin until one ships.
• If the plugin cannot be removed immediately, restrict access to the affected endpoints via a web application firewall, blocking unauthenticated requests that reach the OTP handling logic.
• Audit administrator accounts for unexpected additions, review recent plugin and theme changes, and rotate all WordPress salts and admin credentials.
• Check web server logs for anomalous requests to plugin endpoints originating from untrusted sources.
• For incident tracking and disclosure context, see breach reports and security news.

Security Insight

This case fits a recurring pattern in WordPress plugin security: authentication and authorization logic bolted onto plugins that were never designed as access-control layers, yet get trusted as one. The OTP plugin’s job is to add a verification step, but the privilege assignment flaw means the check can be bypassed entirely, turning a security control into the attack surface. WordPress site owners should treat any plugin that touches authentication or role assignment as high-risk, and prioritize those for patch tracking over cosmetic extensions.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs