{"id":"CVE-2026-106610","published":"2026-10-10T19:16:57.187","lastModified":"2026-10-13T13:28:15.717","description":"Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-5-5-7-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The miniOrange OTP verification plugin contains a privilege assignment flaw that allows unauthenticated users to escalate privileges and gain administrative access to the WordPress site. This critical vulnerability enables attackers to fully compromise the affected system without needing valid credentials.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability allows privilege escalation without authentication, requiring only access to the plugin's functionality.","blast_radius":"If exploited, this vulnerability could lead to complete compromise of WordPress sites using the miniOrange OTP plugin, allowing attackers to modify content, steal data, install malware, and potentially use the compromised site as a launchpad for further attacks.","remediation":"Immediate remediation is to upgrade to version 5.5.8 or later, which contains the fix for this privilege assignment vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:07.165Z"}}