A critical authentication bypass vulnerability in the miniOrange 2FA WordPress plugin allows unauthorized actors to hijack user accounts by rebinding multi-factor authentication settings.

This vulnerability is an improper authentication flaw where the plugin fails to bind a second factor to the target account during the pre-login challenge. An unauthenticated attacker possessing a valid password can rebind the account's second factor to an attacker-controlled destination.

Successful exploitation allows for full account takeover, including administrative accounts, bypassing the primary security benefit of multi-factor authentication. Given the CVSS score of 7.5, this poses a significant risk to organizational integrity, potentially leading to unauthorized data access and administrative system compromise.

Immediate Action: Update the miniOrange 2FA plugin to version 6.2.7 or later immediately to resolve the authentication logic error.

Proactive Monitoring: Review authentication logs for anomalous configuration changes or unexpected 2FA setup activity associated with high-privilege accounts.

Compensating Controls: While a patch is available, implement strict access controls on the WordPress administrative dashboard and utilize a Web Application Firewall to monitor for suspicious POST requests targeting the 2FA configuration endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists.

This vulnerability represents a high-risk security gap that effectively neutralizes second-factor protections. Organizations must prioritize the update to version 6.2.7 to close this bypass vector and prevent potential account takeovers.