---
id: CVE-2026-85984
title: >-
  The miniOrange OTP Login, Verification and SMS Notifications plugin for
  WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent
  parameter in all versions up to, and including, 5.5.5
summary: >-
  The miniOrange OTP Login, Verification and SMS Notifications plugin for
  WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent
  parameter in all versions up to, and including, 5.5.5. This is due to a
  missing password-…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
vendor: cyberlord92
product: 'miniOrange OTP Login, Verification and SMS Notifications'
affected:
  - miniorange_otp_login_verification_and_sms_notifications <= 5.5.5
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T23:16:38.380'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85984'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/includes/js/loginform.js#L176
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/views/forms/mowploginform.php#L134
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3687601/miniorange-otp-verification
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/2895f0c2-41b6-4b11-9865-3bded4402aa9?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-09-26T22:44:09.022623Z'
ingestedAt: '2026-09-26T18:36:42.663Z'
---

## Overview

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.