IntegSec@integ_sec
CVE-2026-16036: miniOrange 2FA WordPress Account Takeover Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04zdHPY0
000007
35 followersView on X
CVE-2026-16036
LOWCVSS 7.5 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled destination, complete the challenge, and take over the account, including administrator accounts.
0.0/ 10 priority
Sources & remediation
Weakness type (CWE)
CWE-287
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
By indicator