CVE-2026-77770 — miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

Description (CNA)

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Affected (CNA)

Vendor / product	Versions
Unknown / miniOrange 2FA	affected 5.3.24 before 6.3.1
Unknown / miniOrange 2FA	affected 18.0 before 19.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.