ZeroDay Findings
Sign inSign up

Findings

Vulnerability · CVE-2026-103895

Improper Authentication

Published Oct 15, 2026 · corrected/updated Oct 16, 2026 · cyberlord92 miniOrange OTP Login, Verification and SMS Notifications · evidence confidence very high

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the function. This is due to short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag ( ) being stored as a row keyed solely by target user ID with no binding to the originating session, cookie, IP address, or device. This makes it possible for unauthenticated attackers to authenticate as any WordPress user — including administrators — by submitting only a known username with the parameter and any non-empty password, thereby inheriting a legitimate user's open Delay OTP grace window without ever supplying correct credentials. Exploitation requires the site to have OTP-only login ( , ) and Delay OTP Verification ( ) enabled, and the target account must currently be within its configured Delay OTP interval.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-103895 is a high public vulnerability record for cyberlord92 miniOrange OTP Login, Verification and SMS Notifications. CISA lists it as known exploited. Published remediation guidance: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether cyberlord92 miniOrange OTP Login, Verification and SMS Notifications is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: cyberlord92 miniOrange OTP Login, Verification and SMS Notifications. Published remediation guidance: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 8.1, EPSS 0.4%. CISA lists it as known exploited. Weakness classes: CWE-287. Sources contributing to this record: cve_org, epss, nvd, vulncheck_kev. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

  • Exploitation evidence

    Confirmed in CISA KEV since Oct 15, 2026. Listed in CISA KEV and VulnCheck KEV.

  • Patch and remediation

    Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Technology hubs

WordPress

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · CISA KEV

    Known exploited

    Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

  2. Oct 16, 2026 · NIST NVD

    Detected

    The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the function. This is due to short-circuiting the authentication flow before password validation or the administrator intent gate (added in 5.5.6) can run, combined with the Delay OTP grace flag ( ) being stored as a row keyed solely b

Affected

  • vendor cyberlord92 miniOrange OTP Login, Verification and SMS Notificationsversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-103895

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-103895

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-103895

    The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the function. This is due to short-circuiting the authentication flow

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2026-103895

    The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.5.8 via the function. This is due to short-circuiting the authentication flow before password validation or the administrat

    vulncheck.com

References