miniOrange 2FA CVE-2026-77770: Update to 6.3.1 — Unauthenticated Option Deletion Locks Out Every Admin

miniOrange 2FA, a two-factor authentication plugin for WordPress, contains a flaw that lets an unauthenticated visitor delete site options by name. It is tracked as CVE-2026-77770.

The advisory names two consequences: every administrator can be locked out of the dashboard, or every plugin on the site can be deactivated. A plugin installed to protect logins can become the reason nobody can log in.

There is one thing to do: update to 6.3.1 (free) or 19.3 (Pro) today.

What to do right now

• ✓Check the version on your Plugins screen. The affected ranges registered by WPScan, the CNA for this CVE, are 5.3.24 up to but not including 6.3.1 for the free plugin and 18.0 up to but not including 19.3 for Pro. If you are on something older than those ranges, update anyway — it is still not the fixed release.
• ✓Update. Free version 6.3.1 was published on WordPress.org on 7 September 2026, and its changelog explicitly records the fix for "unauthenticated arbitrary WordPress option deletion via the email-verification link handler".
• ✓Turn on auto-updates for this plugin so the next fix of this kind lands without you watching for it.
• ✓After updating, confirm you can still sign in as an administrator. Updating closes the entry point; it does not restore options that were already deleted.
• ✓Count every site you run. WordPress.org reports 10,000+ active installations, so do not stop after fixing one site.

Where that score comes from. The 10.0 above is the CVSS v3.1 value assigned by WPScan, the CNA that issued this CVE, with the vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H`. NVD lists this record as "Deferred" and carries no NIST score of its own, and there is no v4.0 assessment at the time of writing.

The vector describes the shape of the risk. `PR:N` (no privileges) and `UI:N` (no user interaction) mean anyone can reach it; `C:N` with `I:H` and `A:H` mean this is not a data-theft bug but a break-your-site bug. The maximum 10.0 comes from `S:C` — the impact crosses out of the plugin and into the whole site.

The missing check

According to NVD, the plugin took the name of the option to delete from unauthenticated request input without requiring a validated transaction first. WPScan classifies it as CWE-862 (Missing Authorization) and maps it to OWASP Top 10 A5: Broken Access Control.

WordPress options are where a site keeps its settings — the site title and URL, which plugins are active, and much more. This flaw lets an outsider name one and delete it.

Note the irony. The stated impacts are locking out every administrator and deactivating every plugin — and the plugins that get deactivated include miniOrange 2FA itself.

Two-factor authentication is the last line of defence after a password leaks. If it can be switched off from the outside, leaving this unpatched means your login protection can be removed at an attacker's convenience.

No exploitation seen yet — but there is a date on the calendar

Stated plainly, without inflation:

This CVE is not in CISA's Known Exploited Vulnerabilities catalog. The CISA SSVC assessment recorded alongside the NVD entry says `exploitation: none`.

Two things still argue for patching today. The same assessment marks it `automatable: yes`, and WPScan has announced that the proof of concept will be published on 8 October 2026. The quiet period is the time you have, and its end date is already fixed.

Affected and fixed versions

• ▸Affected: miniOrange 2FA (free), 5.3.24 up to but not including 6.3.1 (the range registered in the CVE record)
• ▸Affected: miniOrange 2FA Pro, 18.0 up to but not including 19.3 (same source)
• ▸Fixed: free 6.3.1 (published on WordPress.org on 7 September 2026) and Pro 19.3
• ▸Disclosure: published by WPScan on 8 September 2026; added to NVD on 10 September 2026
• ▸Scale: 10,000+ active installations reported by WordPress.org

If something already looks wrong

Updating stops what has not happened yet. It does not bring back options that are already gone. If you see the signs below, treat recovery as a separate decision from patching.

• ✓You cannot sign in, or your administrator rights no longer work. An unexplained lockout is exactly the impact named in the advisory.
• ✓Plugins have been deactivated across the board without you or another administrator doing it.
• ✓Consider restoring from backup first. If your hosting or VPS panel keeps automatic backups, pick a point before the symptoms appeared. Take a fresh backup of the current state before you restore anything.
• ✓Update the plugin to the fixed version on both sides of the restore. Restoring an old copy re-opens the same door.
• ✓Preserve your access logs. They are what you and your hosting provider will need to work out what happened, and they get rotated away.

This article deliberately offers no workaround configuration or WAF rule. Publishing guesses that the vendor has not confirmed would hand you a false sense of safety. The published remedy is the update.