{"id":"CVE-2026-111949","kind":"vulnerability","aliases":["CVE-2026-111949"],"related":[],"title":"WordPress 2FA plugin lets password-holding attacker bypass second factor via passkey","description":"The miniOrange 2FA  WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that already has one configured, allowing an attacker who knows a user's password to add their own authenticator and bypass the second factor.","summary":"The miniOrange 2FA WordPress plugin before 6.3.1 lets a pending passkey login register an extra passkey on an account that already has one. An attacker who knows a user's password can add their own authenticator and get past the second factor.","severity":"high","cvss":7.5,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-6.3.1-or-later"],"how_to_check":"- Check the installed miniOrange 2FA plugin version in the WordPress admin plugins list or with `wp plugin get miniorange-2-factor-authentication --field=version` (plugin slug unknown from sources; verify the slug)\n- Confirm whether passkey login is enabled in the plugin settings","fix":"- Update the miniOrange 2FA plugin to `6.3.1` or later\n- Review each user's registered passkeys and remove any that are unrecognized","status":"open","published_at":"2026-10-21T06:16:48+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:17:00+00:00","updated_at":"2026-10-25T03:17:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:17:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the miniOrange 2FA plugin to `6.3.1` or later\n- Review each user's registered passkeys and remove any that are unrecognized","reach":"internet","title":"WordPress 2FA plugin lets password-holding attacker bypass second factor via passkey","impact":"high","summary":"The miniOrange 2FA WordPress plugin before 6.3.1 lets a pending passkey login register an extra passkey on an account that already has one. An attacker who knows a user's password can add their own authenticator and get past the second factor.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker bypasses second factor and gets full account access","analyst_note":"","how_to_check":"- Check the installed miniOrange 2FA plugin version in the WordPress admin plugins list or with `wp plugin get miniorange-2-factor-authentication --field=version` (plugin slug unknown from sources; verify the slug)\n- Confirm whether passkey login is enabled in the plugin settings","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-6.3.1-or-later"],"who_is_affected":"Sites running the miniOrange 2FA WordPress plugin before 6.3.1 that use passkey login for their users. Sites without this plugin, or without passkeys enabled, are not affected by the sources' description. The attack needs a valid username and password, so the password itself must be compromised first.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000615,"input_tokens":3349,"output_tokens":560,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111949':16A,19A '-2026':15A,18A '2fa':2A,27B,69C '6.3.1':31B,73C 'account':43B,88C 'add':57B,104C 'addit':84C 'allow':94C 'alreadi':45B,90C 'attack':8A,49B,96C 'authent':60B,107C 'bypass':9A,109C 'configur':93C 'cve':14A,17A 'extra':39B 'factor':11A,66B,112C 'get':62B 'hold':7A 'host':23B 'know':51B,98C 'let':4A,32B 'login':36B,80C 'miniorang':26B,68C 'one':47B,92C 'packag':20B 'passkey':13A,35B,40B,79C,85C 'password':6A,55B,102C 'password-hold':5A 'past':63B 'pend':34B,78C 'plugin':3A,29B,71C 'prevent':76C 'regist':37B,82C 'second':10A,65B,111C 'self':22B 'self-host':21B 'user':53B,100C 'via':12A 'wordpress':1A,24B,28B,70C","nicknames":[],"mitigations":[],"who_affected":"Sites running the miniOrange 2FA WordPress plugin before 6.3.1 that use passkey login for their users. Sites without this plugin, or without passkeys enabled, are not affected by the sources' description. The attack needs a valid username and password, so the password itself must be compromised first.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111949","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111949","severity":null,"published_at":"2026-10-21T06:16:48+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111949","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111949","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}