CVE-2026-103895 cyberlord92 CVE debrief

Who should care

WordPress administrators and defenders who use the miniOrange OTP Login, Verification and SMS Notifications plugin should assess their exposure and verify the presence of this vulnerability in their installations.

Why it matters

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and ensure that the plugin is updated to a fixed version. This vulnerability allows unauthenticated attackers to authenticate as any WordPress user, including administrators, which can lead to unauthorized access and potential further exploitation.

• Unauthenticated attackers can authenticate as any WordPress user, including administrators
• Exploitation requires OTP-only login and Delay OTP Verification to be enabled
• The target account must currently be within its configured Delay OTP interval

Technical summary

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the `mo_by_pass_login()` function. This is due to `mo_delay_otp_process()` short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag (`mov_last_verified_dttm`) being stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and ensure that the plugin is updated to a fixed version.

Recommended defensive actions

• Verify the presence of this vulnerability in your WordPress installations
• Ensure that the plugin is updated to a fixed version
• Review authentication settings for OTP-only login and Delay OTP Verification
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the `mo_delay_otp_process()` function short-circuiting the authentication flow before password validation or the administrator intent gate can run. The Delay OTP grace flag is stored as a `user_meta` row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.