CVE-2026-85984: miniOrange OTP Login Plugin Authentication Bypass

Overview

A critical authentication bypass vulnerability has been disclosed in miniOrange OTP Login, Verification and SMS Notifications, a WordPress plugin developed by cyberlord92 that adds one-time-password login, verification, and SMS notification capabilities to WordPress sites. Tracked as CVE-2026-85984 and rated CVSS 9.8 (Critical), the flaw allows an unauthenticated attacker to log in as any existing administrator account by submitting nothing more than a known username and a crafted POST parameter — no password and no OTP required.

The vulnerability was publicly disclosed on September 26, 2026, and affects all plugin versions up to and including 5.5.5. As of publication, no public exploit code has been confirmed and the CVE has not been added to CISA's Known Exploited Vulnerabilities catalog, but the pre-authentication nature of the bug and the ubiquity of OTP-login plugins on WordPress sites make rapid weaponization plausible.

Technical Details

How It Works

The root cause is a missing password-intent guard in the skip_pass_fallback-enabled branch of the plugin's mo_by_pass_login() function. When an unauthenticated request submits the POST parameter mo_wp_login_intent with the value otp, the plugin's mo_get_user() routine treats administrator role membership alone as sufficient proof of identity — it never calls WordPress's own wp_authenticate_username_password() check, and instead resolves a WP_User object purely from a username lookup.

In practice, this means an attacker who knows (or guesses) a valid administrator username can submit a login request with an empty password and mo_wp_login_intent=otp, and the plugin will hand back an authenticated session for that administrator — bypassing both the password check and the OTP/SMS verification the plugin is supposed to enforce.

Exploitation Prerequisites

Exploitation depends on the site administrator having simultaneously enabled a specific combination of plugin settings:

• WP Login OTP
• Login with Only OTP
• Allow Users to Login with Username and Password
• Admin OTP Bypass

Sites that have not enabled this combination — or that do not use the plugin's OTP-bypass fallback feature at all — are not exploitable via this specific code path. However, given that these are precisely the settings site owners enable to make OTP login "convenient" for administrators, the vulnerable configuration is a realistic and likely common one among the plugin's active install base.

Impact Assessment

Who Is At Risk

• WordPress sites with the miniOrange OTP Login, Verification and SMS Notifications plugin active on version 5.5.5 or earlier
• Sites where WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass are all enabled together
• Multi-site or managed WordPress hosting environments where the plugin is bundled or enabled by default across many tenant sites
• Sites where administrator usernames are predictable (e.g., admin, company-name patterns, or exposed via author archive pages/REST API user enumeration)

Potential Attack Chains

1. Username Enumeration — Attacker identifies a valid administrator username via WordPress's REST API, author archives, or login error messages
2. Authentication Bypass — Attacker submits a login POST request with the target username, an empty password, and mo_wp_login_intent=otp
3. Session Establishment — mo_by_pass_login() resolves the user purely by username and grants an authenticated administrator session
4. Full Compromise — Attacker uses admin dashboard access to install a malicious plugin/theme for persistent remote code execution, create backdoor accounts, exfiltrate data, or pivot to other systems sharing credentials

Mitigation

Immediate Actions

• Update the plugin to the latest version available from the WordPress Plugin Directory. A fix has been committed upstream to the plugin's SVN repository; confirm the installed version is newer than 5.5.5 before considering the site remediated
• Disable the vulnerable setting combination immediately if an update is not yet deployable — turn off Admin OTP Bypass and/or skip_pass_fallback-related options in the plugin's login settings until patched
• Audit administrator accounts for unrecognized users, unexpected role changes, or recently installed plugins/themes that were not authorized
• Force a password reset for all administrator accounts and rotate any credentials or API keys stored in the WordPress environment as a precaution

Detection Opportunities

• Review web server and WAF logs for POST requests to wp-login.php (or the plugin's login-handling endpoint) containing mo_wp_login_intent=otp combined with an empty or missing password field
• Look for successful administrator logins that do not correspond to a normal password-entry or OTP-delivery flow in plugin/application logs
• Monitor for new administrator account creation, plugin/theme installation, or file changes immediately following a suspicious login event
• Flag login attempts targeting known/common administrator usernames at unusual volume, which may indicate reconnaissance ahead of exploitation

Defence-in-Depth

• Deploy a Web Application Firewall rule to block or flag requests containing the mo_wp_login_intent parameter with the value otp from unauthenticated sessions
• Disable WordPress user/username enumeration via the REST API and author archive URLs to reduce the attacker's ability to identify valid admin usernames
• Enforce strong, non-predictable administrator usernames separate from display names
• Apply the principle of least privilege — avoid granting Administrator role to accounts that do not require it, limiting the blast radius of any single compromised credential
• Maintain an up-to-date plugin inventory and subscribe to vulnerability feeds (Wordfence, Patchstack, WPScan) for the plugins in active use

Key Takeaways

1. CVE-2026-85984 is a critical (CVSS 9.8) authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin, affecting all versions ≤ 5.5.5.
2. The flaw stems from a missing password-intent guard in mo_by_pass_login() — submitting mo_wp_login_intent=otp lets the plugin skip password and OTP verification entirely.
3. Exploitation requires a specific combination of plugin settings (WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass) to be enabled together.
4. A successful attack grants full, unauthenticated administrator access using only a known or guessed username.
5. No public exploit code or in-the-wild exploitation has been confirmed as of publication, but the low complexity of the attack warrants urgent patching.
6. Update the plugin immediately, or disable the vulnerable setting combination as an interim mitigation, and audit admin accounts for signs of prior compromise.

References

• NVD — CVE-2026-85984
• VulDB — CVE-2026-85984
• OffSeq Threat Radar — CVE-2026-85984
• Patchstack — miniOrange OTP Verification Plugin Vulnerability Database