CVE-2026-77770

CRITICAL 10.0CVE-2026-77770 · Published 10/09/2026 · updated 10/09/2026

In short

CVE-2026-77770 is a CRITICAL (CVSS 10.0) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

References

wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free