CVE-2026-14245 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-14245 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-14245 is a critical authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress, affecting all versions up to and including the latest patched release, which allows unauthenticated attackers to fully compromise administrator accounts.

Technical Detail

The flaw resides in the authentication logic of the miniOrange WordPress plugin, where insufficient verification of OTP or identity tokens allows an unauthenticated remote attacker to bypass the login process entirely. By manipulating or skipping the expected authentication steps, an attacker can assume the identity of an existing administrator account without valid credentials. Successful exploitation results in full administrative account takeover, granting the attacker complete control over the WordPress installation, including the ability to install malicious plugins, modify content, or pivot to the underlying server.

Exploitation Status

No known exploit code has been publicly documented or observed in the wild as of July 16, 2026. This vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.8 and the unauthenticated attack vector make this a high-priority target for opportunistic threat actors, and the exploitation barrier is low given the nature of authentication bypass flaws.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability. Organizations should not interpret the absence of attribution as an indicator of low risk, given the severity and broad WordPress deployment surface.

What To Do

Update the miniOrange OTP Login, Verification and SMS Notifications plugin to the latest available version immediately, prioritizing any release issued after the affected version range. If a patched version is not yet available from the vendor, the recommended interim measure is to deactivate and remove the plugin until a fix is confirmed. WordPress administrators should audit recent administrator account activity and review logs for unexpected account creation or privilege changes. Network-level controls such as restricting wp-login.php and wp-admin access to known IP ranges can reduce exposure. Monitor the WordPress plugin repository and the miniOrange vendor advisory channel for patch confirmation and version guidance.