A critical vulnerability in the miniOrange 2FA WordPress plugin allows unauthenticated attackers to perform unauthorized site configuration changes, posing a high risk of administrative lockout.

This flaw stems from missing authorization checks (CWE-862) within the plugin, where site options can be deleted via unauthenticated request input. Because the application does not validate the transaction, any visitor can execute destructive actions against the WordPress database.

The ability for an unauthenticated user to delete arbitrary site options presents a severe risk to service availability and administrative control. By removing critical options, an attacker can effectively lock all administrators out of the dashboard or force the deactivation of security plugins, leaving the site vulnerable to further compromise. With a CVSS score of 10.0, this issue is classified as critical due to the potential for complete loss of administrative integrity and site availability.

Immediate Action: Update the miniOrange 2FA plugin to version 6.3.1 or 19.3 immediately to incorporate the necessary authorization checks.

Proactive Monitoring: Review web server access logs for anomalous requests directed at administrative endpoints or unusual POST requests containing parameters related to site option modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious or unauthorized attempts to access sensitive WordPress administrative functions or option-handling endpoints.

Public Exploit Available: No

Given the critical severity of this vulnerability and the ease with which an attacker can disrupt administrative access, immediate remediation is required. Security teams should prioritize updating the miniOrange 2FA plugin across all WordPress instances. If an immediate update is not feasible, administrators should consider temporarily deactivating the plugin or restricting access to the site dashboard until the patch is successfully applied.