{"schema":"threatline.record/2","record":{"id":"CVE-2026-85984","aliases":[],"summary":"miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter","details":"The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass via the mo_wp_login_intent parameter in all versions up to, and including, 5.5.5. This is due to a missing password-intent guard in the skip_pass_fallback-enabled configuration branch of the mo_by_pass_login() function, which treats administrator role membership alone as sufficient authentication whenever the unauthenticated, unverified POST parameter mo_wp_login_intent is submitted with the value otp, causing mo_get_user() to skip wp_authenticate_username_password() and resolve a WP_User purely from a username lookup. This makes it possible for unauthenticated attackers to log in as any existing administrator account by supplying only a known username and an empty password alongside mo_wp_login_intent=otp, with no password or OTP verification required. Exploitation is conditional on a site administrator having simultaneously enabled the following plugin options: WP Login OTP, Login with Only OTP, Allow Users to Login with Username and Password, and Admin OTP Bypass.","categories":["Unclassified"],"product":"miniOrange OTP Login, Verification and SMS Notifications","vendor":"cyberlord92","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85984","source_modified_at":"2026-09-26T22:51:17.200Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"miniOrange OTP Login, Verification and SMS Notifications","vendor":"cyberlord92","versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.5.5","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00674,"percentile":0.51583,"score_date":"2026-10-23"},"published_at":"2026-09-26T17:28:59.138Z","modified_at":"2026-09-26T22:51:17.200Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-85984","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-26T22:51:17.200Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85984","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/2895f0c2-41b6-4b11-9865-3bded4402aa9?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/views/forms/mowploginform.php#L134"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/miniorange-otp-verification/tags/5.5.5/includes/js/loginform.js#L176"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset/3687601/miniorange-otp-verification"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-09-26T22:44:09.022623Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-26T22:51:17.200Z","content_hash":"9ce22a16603774a585bfe05980103d36ed814d1c5e4e77ea555052b83f1b27d2"}}