CVE-2026-14245: WordPress miniOrange Auth Bypass Flaw

CVE-2026-14245 Overview

CVE-2026-14245 is an authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress. All versions up to and including 5.5.1 are affected. The flaw resides in the um_reset_password_process_hook() function, which fails to verify server-side that the one-time password (OTP) validation step was completed. An unauthenticated attacker can request a password reset for any WordPress account, including an Administrator, by supplying an attacker-controlled username_b parameter together with a public form_nonce that the plugin itself emits to visitors. The server responds with a valid password-reset URL in a 302 Location header, enabling full account takeover.

Critical Impact
Unauthenticated attackers can obtain a password-reset URL for any Administrator account and take complete control of the affected WordPress site.

Affected Products

miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress
All versions up to and including 5.5.1
Sites with the Ultimate Member Password Reset Form integration active and not configured for phone-only reset

Discovery Timeline

2026-07-09 - CVE-2026-14245 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-14245

Vulnerability Analysis

The vulnerability is a Missing Authorization flaw categorized as [CWE-862]. The plugin implements a multi-step password reset flow that begins with a user requesting an OTP, entering the OTP for validation, and finally submitting a new password. The um_reset_password_process_hook() handler responsible for the final step does not confirm that the OTP validation step actually completed for the targeted account. This breaks the intended state machine and allows the reset flow to be driven directly to the final step.

The handler still enforces a nonce check using form_nonce, but that nonce is not secret. The plugin emits it inside the moumprvar JavaScript object on the Ultimate Member password reset page, which is reachable by unauthenticated visitors. An attacker simply loads the reset page, extracts the nonce, and reuses it in a crafted request.

Root Cause

The root cause is missing server-side authorization binding between the OTP challenge and the reset action. The username_b parameter is accepted without validating that the current session previously passed OTP verification for that username. There is also no role restriction, so administrator accounts are equally targetable. The form_nonce serves only as CSRF protection and is not a substitute for authorization.

Attack Vector

The attack is remote, unauthenticated, and requires no user interaction. An attacker fetches the Ultimate Member password reset page, parses the moumprvar JavaScript object to obtain form_nonce, and submits a POST request to the reset endpoint with username_b set to the target Administrator username. The plugin returns a 302 redirect whose Location header contains a freshly generated password reset URL bound to the targeted account. Following that link allows the attacker to set a new password and log in as the Administrator.

Refer to the annotated plugin source in the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for the affected code paths.

Detection Methods for CVE-2026-14245

Indicators of Compromise

POST requests to the Ultimate Member password reset endpoint containing a username_b parameter targeting privileged accounts.
302 responses with Location headers containing WordPress password reset URLs for administrator usernames issued to unauthenticated clients.
New administrator logins from previously unseen IP addresses shortly after password reset activity.
Unexpected password changes on administrator accounts recorded in the WordPress user_activation_key column of wp_users.

Detection Strategies

Inspect web server access logs for repeated requests to the Ultimate Member password reset page followed by reset submissions using different username_b values.
Alert on any password reset submission where the target username resolves to a user with the administrator role.
Correlate password reset events with subsequent administrator session creation from the same client IP or user agent.

Monitoring Recommendations

Enable WordPress audit logging for password reset events, user role changes, and administrator logins.
Monitor plugin version inventory across WordPress estates to identify sites still running miniOrange OTP Verification 5.5.1 or earlier.
Forward web application firewall (WAF) and WordPress audit logs to a centralized SIEM for correlation and long-term retention.

How to Mitigate CVE-2026-14245

Immediate Actions Required

Update the miniOrange OTP Login, Verification and SMS Notifications plugin to a version later than 5.5.1 as soon as a fixed release is available.
If a patched version is not yet available, deactivate the plugin or disable the Ultimate Member Password Reset Form integration.
Rotate credentials for all administrator accounts and invalidate active sessions.
Review recent password reset activity and administrator account changes for signs of exploitation.

Patch Information

The vulnerability is present in all versions up to and including 5.5.1. Review the WordPress Plugin Change Set and the Wordfence Vulnerability Report for the current status of vendor fixes and upgrade guidance.

Workarounds

Configure the plugin for phone-only reset, which is not exploitable through this code path, if that workflow is compatible with the deployment.
Block unauthenticated access to the Ultimate Member password reset page at the WAF or reverse proxy layer.
Restrict administrator account usernames from being enumerable and enforce multi-factor authentication (MFA) at the WordPress login layer to reduce takeover impact.

bash

# Example WAF rule concept: block reset submissions targeting admin usernames
# (adapt syntax to your WAF; illustrative only)
SecRule REQUEST_METHOD "@streq POST" \
  "chain,phase:2,deny,status:403,id:1026142450,\
   msg:'CVE-2026-14245 miniOrange OTP reset abuse'"
  SecRule ARGS:username_b "@rx ^(admin|administrator|root)$" \
    "t:lowercase"