CVE-2026-77770

10.0 Critique

Publiée le 10/09/2026 à 09:17 · Modifiée le 10/09/2026 à 17:13 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Traduire en français

Produits concernés

Unknown miniOrange 2FA

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H`

Faiblesses (CWE)

CWE-862

Références

https://wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories