The miniOrange 2FA plugin, installed on more than 10,000 WordPress sites to add two-factor login protection, shipped a fix on September 7, 2026 for a maximum-severity flaw that let anyone, logged in or not, delete arbitrary WordPress options on the site. Tracked as CVE-2026-77770 and assigned a CVSS score of 10.0, the bug sat in versions before 6.3.1 of the free edition and before 19.3 of the Pro edition, according to NVD’s entry for the flaw.
What CVE-2026-77770 Actually Breaks
The plugin’s email-verification link handler deleted WordPress options using names pulled straight from the request, without checking whether the person making the request had ever logged in or held a valid nonce. An attacker could point a single crafted link at that handler and wipe out options the site depends on.
That is a strange thing for a two-factor plugin to get wrong, because the options at risk include the plugin’s own configuration. Deleting the right keys can disable miniOrange 2FA outright, stripping the exact login protection a site installed the plugin to get. Deleting others can knock out admin access to the dashboard entirely, since some of WordPress’s own core options can be targeted the same way.
The vendor’s changelog for 6.3.1 lists the fix alongside a second patch, for a client-controlled counter that let attackers bypass the 2FA lockout after repeated failed attempts and a missing rate limit on the configuration-validation endpoint. Neither of those carries its own CVE as severe as the option-deletion bug, but both point the same direction: the access-control logic around this plugin’s verification flows needed a real audit, not a patch here and there.
Who Needs to Update
Anyone running miniOrange 2FA, Two-Factor Authentication for WordPress. Check the version under Plugins in wp-admin: anything before 6.3.1 on the free track or 19.3 on Pro is exposed. The current release on the WordPress.org repository is already 6.3.1, so a normal “update plugins” pass clears it, which is the easiest fix available here, not a workaround.
There is no indication yet of in-the-wild exploitation, but an unauthenticated, no-interaction bug that can lock out every admin on a site tends not to stay quiet for long once a proof of concept circulates. Sites that can’t update immediately should at minimum confirm they have a working path back into wp-admin that does not depend on the plugin, in case someone gets there first.
This is also a good prompt to look past just this one plugin. Any plugin that handles login, password reset, or account verification is effectively part of a site’s access-control layer, and a gap in one of those flows is worse than the same bug in a feature that doesn’t touch authentication. Clients who want that layer checked rather than assumed safe are usually better served by a proper audit through WordPress development work than by waiting for the next CVE to land. Two other access-control bugs worth knowing if you manage WordPress sites: TranslatePress’s password-reset takeover flaw from last month, and Ultimate Member’s privilege escalation bug, both in the same family of “the login flow trusted something it shouldn’t have.”
