Skip to content
eastbaycyber

CVE-2026-85984: WordPress OTP Bypass

CVE explainers 8 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-09-26
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - CVE-2026-85984 is a critical authentication bypass in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress. - Versions through 5.5.5 are affected when four specific login settings are enabled together. - No confirmed public proof of concept or active exploitation has been identified, but affected sites should disable the vulnerable configuration immediately. - The definitive fixed plugin version has not been confirmed in the available primary-source material.

Vulnerability at a Glance

Field Details
CVE ID CVE-2026-85984
Product miniOrange OTP Login, Verification and SMS Notifications for WordPress
CVSS 9.8 Critical
Attack vector Network-based web request
Authentication required No valid password or OTP is required on the vulnerable path
Affected versions All versions up to and including 5.5.5
Patch available No confirmed fixed release identified in the available primary-source material
CISA KEV status Not listed

CVE-2026-85984 is a WordPress authentication-bypass vulnerability in the miniOrange OTP Login plugin. Under specific settings, an unauthenticated attacker may authenticate as an existing WordPress administrator by supplying a known administrator username, an empty password, and the mo_wp_login_intent=otp parameter.

The vulnerability is conditional rather than universally exploitable on every installation. The site must have a particular combination of plugin settings enabled. Successful exploitation can provide administrator-level access without a valid password or OTP, making installations with that configuration critical-risk assets.

For background on CVE identifiers and vulnerability records, see the CVE glossary.

What Is CVE-2026-85984?

The vulnerable execution path is associated with the mo_by_pass_login() function and its handling of the skip_pass_fallback behavior. The affected logic does not correctly enforce password intent before resolving a user. In the vulnerable branch, the plugin can bypass the normal WordPress username-and-password authentication function, wp_authenticate_username_password().

Instead, the flow may resolve a WP_User object through a username lookup. When a request indicates an OTP login using mo_wp_login_intent=otp, administrator-role membership can be treated as sufficient to continue authentication. The request therefore does not need to contain a valid password or a successfully validated OTP.

A practical attack requires knowledge of an existing administrator username. That information may be exposed through author archives, WordPress REST API responses, password-reset workflows, public content, or other application behavior. Username disclosure is not the root cause, but it can make exploitation substantially easier. Defenders should not assume that hiding author names alone mitigates the vulnerability.

AnalystImpact · assess the risk

Who Is Affected?

The affected product is the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress. The available vulnerability record identifies the affected range as:

All versions up to and including 5.5.5

No narrower affected range was provided in the retrieved material, and no additional product variants were identified. WordPress sites using version 5.5.5 or earlier should therefore be considered affected until the plugin vendor or WordPress.org metadata confirms a fixed release.

Exploitation requires all of the following plugin options to be enabled:

  1. WP Login OTP
  2. Login with Only OTP
  3. Allow Users to Login with Username and Password
  4. Admin OTP Bypass

Analyst’s Take: Prioritize sites running version 5.5.5 or earlier with all four settings enabled. Because no definitive fixed version is confirmed, disabling that combination or deactivating the plugin is the dependable immediate control.

Sites that do not use the plugin’s login functionality may have a simpler response: deactivate and remove the plugin. Sites that require it should inspect the configuration and disable the affected combination while establishing a supported upgrade path.

CVSS Score and Impact

CVE-2026-85984 has a reported CVSS base score of 9.8, classified as Critical. The available NVD response supplied the score but did not include the CVSS vector string. Individual vector values should not be represented as confirmed facts without checking the current authoritative CVE record.

The score is consistent with a remotely reachable authentication bypass that can affect confidentiality, integrity, and availability after administrator access is obtained. Potential consequences include:

  • Reading or changing WordPress content
  • Installing or modifying plugins and themes
  • Creating persistent administrator accounts
  • Altering site configuration
  • Accessing sensitive site data
  • Using the server as a foothold for further activity

A high CVSS score does not mean every installation is immediately exploitable. The required plugin settings create an environmental prerequisite. Conversely, the absence of a password requirement makes a correctly configured vulnerable site particularly exposed once an administrator username is known.

Exploitation Status

No confirmed in-the-wild exploitation was identified in the retrieved NVD or CISA Known Exploited Vulnerabilities data. CVE-2026-85984 is not currently listed in CISA KEV, and no CISA ransomware-campaign association, KEV due date, or required action is reported.

A public proof of concept is also not confirmed. The available research did not identify a reliable GitHub exploit repository, vendor-published PoC, or credible public exploitation report specifically tied to this CVE. The authentication flow is technically straightforward, so defenders should not interpret the lack of a published PoC as evidence of low risk.

CISA KEV absence is not proof that exploitation has never occurred. It means only that CISA has not included the CVE in that catalog based on the retrieved status. Organizations should continue monitoring authentication logs, web access logs, and WordPress administrative changes.

ResponderRunbook · act now

How to Detect CVE-2026-85984

Start by identifying plugin installations and versions across the WordPress estate. The following WP-CLI command can show the installed plugin version on an individual site:

wp plugin get miniorange-otp-verification \
  --fields=name,status,version,update \
  --format=table

Inspect the plugin configuration in the WordPress administrator interface as well. Pay particular attention to whether the four settings listed above are simultaneously enabled. Configuration names and storage details may vary by plugin release, so defenders should avoid relying on an undocumented database option name as the only detection method.

Web server logs may record requests containing the vulnerable parameter. Search URL query strings and POST bodies where application logging captures request bodies. A basic access-log search is:

grep -Ei 'mo_wp_login_intent=otp|mo_wp_login_intent%3Dots?' \
  /var/log/nginx/access.log /var/log/apache2/access.log

The exact encoded form varies by logging and URL-decoding behavior. A SIEM query should look for the parameter near WordPress login endpoints, followed by a successful authentication response or subsequent administrative access. For example:

http_method=POST
AND request_body CONTAINS "mo_wp_login_intent=otp"
AND (uri CONTAINS "wp-login.php" OR uri CONTAINS "wp-admin")

Treat hits as investigation leads rather than definitive exploitation evidence. Correlate the source IP, requested username, HTTP status, session creation, subsequent /wp-admin/ requests, new administrator accounts, plugin changes, and password-reset activity.

Technical Indicators

Useful indicators include requests containing:

mo_wp_login_intent=otp

A suspicious sequence may resemble:

POST /wp-login.php
POST body: log=<administrator-username>&pwd=&mo_wp_login_intent=otp
HTTP response: 302
GET /wp-admin/

Logging implementations differ, and many standard access logs do not record POST bodies. If request-body inspection is not already enabled, do not enable it indiscriminately on production systems because credentials and personal data may be captured. Prefer WAF rules, narrowly scoped temporary logging, or application-level telemetry with appropriate redaction.

Mitigation and Patching

The affected range ends at version 5.5.5, but the definitive fixed version was not confirmed in the available primary-source material. The NVD record references WordPress.org changeset 3687601, which should be reviewed to identify the corrective code change and the first released plugin version containing it.

Until that version is confirmed, do not report an arbitrary release as safe. Check the plugin’s WordPress.org changelog, vendor advisory, and installed update metadata. Once a fixed release is confirmed, update with WP-CLI:

wp plugin update miniorange-otp-verification
wp plugin get miniorange-otp-verification --fields=version,status

If the repository offers a specific confirmed version, pin and verify it according to the organization’s change-control process:

wp plugin update miniorange-otp-verification --version=<confirmed-fixed-version>

For a broader operational framework, review these patch management best practices.

Immediate Workaround

Disable the affected configuration combination, particularly Admin OTP Bypass and any setting that permits the vulnerable fallback behavior. Because the exact internal option names are not confirmed, make the change through the plugin’s administrative interface rather than writing guessed values directly to the WordPress database.

If the plugin is not essential, deactivate it immediately:

wp plugin deactivate miniorange-otp-verification

After mitigation, review all administrator accounts, recent successful logins, active sessions, plugin and theme modifications, scheduled tasks, and unexpected files. If suspicious access is found:

  1. Rotate administrator credentials.
  2. Invalidate active sessions.
  3. Review API keys and application passwords.
  4. Inspect for newly created administrator accounts.
  5. Check for persistence mechanisms and unexpected files.
  6. Review plugin, theme, and WordPress core changes.
  7. Preserve relevant logs for incident investigation.

Organizations that need additional malware and endpoint investigation support may also evaluate Get Malwarebytes →. A plugin update alone does not remove changes an attacker may already have made.

The first action is to identify affected installations and disable the four-setting combination, prioritizing sites that expose the login path to the network. Then verify the fixed release through the plugin’s changelog, vendor advisory, and update metadata before upgrading. Investigate administrator activity rather than treating patching as evidence that prior access did not occur.

References

The WordPress.org Trac source pages were not independently reproduced in the available retrieval session because they returned HTTP 403. The affected version range and technical description should therefore be rechecked against the current NVD, vendor, and WordPress.org records before making a final patch-compliance determination.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-09-26

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.