x.comadvisory♫Why♥Not♪ (@Python_s_) on X
Alert on CVE-2026-106610, a critical (CVSS 9.8) incorrect privilege assignment flaw in the miniOrange OTP Verification WordPress plugin, versions 5.5.7 and earlier. Unauthenticated remote attackers can gain elevated permissions, potentially administrator, with no user interaction. Fixed in 5.5.8; no in-the-wild exploitation or public PoC verified. It advises auditing unexpected admin accounts and role changes, and warns that Patchstack's mitigation blocks legitimate requests too.
TL;DR miniOrange OTP Verification WordPress plugin ≤5.5.7 has an unauthenticated privilege escalation (CVE-2026-106610, CVSS 9.8); update to 5.5.8.
Organisations named here
- incorrect privilege assignment
- miniOrange OTP Verification
CVEs named here
- CVE-2026-106610
Technologies named here
- Patchstack
- WordPress
- CVSS
Techniques named here
- Forensic triage
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup