Live › vulnerability › CVE-2026-111949
Go to dashboardThe miniOrange 2FA WordPress plugin before 6.3.1 lets a pending passkey login register an extra passkey on an account that already has one. An attacker who knows a user's password can add their own authenticator and get past the second factor.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the miniOrange 2FA WordPress plugin before 6.3.1 that use passkey login for their users. Sites without this plugin, or without passkeys enabled, are not affected by the sources' description. The attack needs a valid username and password, so the password itself must be compromised first.
No product ranges from the sources yet.
wp plugin get miniorange-2-factor-authentication --field=version (plugin slug unknown from sources; verify the slug)6.3.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.
This page as .md · .json · in your agent: get_signal("CVE-2026-111949")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.