CVE-2026-42731: miniOrange OTP Verification Plugin - Privilege Escalation
CVE-2026-42731 is a privilege escalation flaw classified as CWE-266 (Incorrect Privilege Assignment) in the miniOrange OTP verification plugin, affecting versions through 5.4.9 according to the record. The CNA assessment rates it critical with a CVSS 3.1 score of 9.8 and no privileges or user interaction required. The record provides no fixed version, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-42731 is a privilege escalation issue classified as CWE-266 (Incorrect Privilege Assignment) in the miniOrange OTP verification plugin (miniorange-otp-verification). The record states that the plugin is affected from an undefined earlier version through 5.4.9 inclusive. The Patchstack reference path indicates a WordPress plugin.
Impact
The CNA assessment assigns a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This describes network exploitation with no privileges or user interaction and high impact on confidentiality, integrity and availability. Because the flaw is a privilege escalation, an account with limited rights could potentially gain higher privileges; the exact preconditions are not detailed in the record.
Affected products and versions
- Product: miniOrange miniorange otp verification (miniorange-otp-verification), a WordPress plugin according to the Patchstack reference.
- Affected range: from 'n/a' through and including 5.4.9, as stated in the description.
- The structured affected list in the record is empty, so no further version data is available.
Exploitation status
This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation appears in the sources consulted. The EPSS data in the record gives a probability of 0.00483 and a percentile of 0.39878.
Remediation and mitigation
- Identify whether the miniOrange OTP verification plugin is installed on WordPress sites and which version is running.
- Check the Patchstack reference and vendor channels for a fixed version, since the record does not provide one.
- Until a fix is confirmed, limit exposure: restrict administrative access, review user roles, and deactivate the plugin if it is not essential.
- Apply the vendor update when it becomes available and verify the installed version afterward.
Detection guidance
- Review WordPress user accounts for unexpected role changes or newly created administrator accounts.
- Review logs for changes to user roles or plugin settings, especially around OTP verification functions.
- Watch for unusual authentication activity or privilege changes that cannot be attributed to known administrators.
Limitations of the available information
The record does not include a fixed version, a structured list of affected products, the CWE name, the technical mechanism of the flaw, or vendor advisory text beyond the reference link. The lower bound 'n/a' is not defined. Dates and EPSS values are reported as they appear in the record.
Frequently asked questions
What is CVE-2026-42731?
It is a privilege escalation vulnerability classified as CWE-266 (Incorrect Privilege Assignment) in the miniOrange OTP verification plugin, as described in the record.
Which versions are affected?
The description states the plugin is affected from an undefined earlier version through 5.4.9 inclusive. The record does not list a fixed version.
Is this vulnerability being exploited?
The CVE is not listed in CISA KEV in the record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.