Published October 26, 2026. Based on public reports available on that date; details may change.
CVE-2026-111949 affects miniOrange 2FA before version 6.3.1, where a login that is still pending through a passkey flow can register an additional passkey. Sites using the plugin should update to 6.3.1 or later, then review passkeys on administrator and other sensitive accounts. The cited public records do not report exploitation in the wild.
What happened
The reported issue is a missing control around a pending passkey login. A passkey login should remain limited to completing the authentication process already in progress. Before version 6.3.1, that pending state does not prevent registration of another passkey.
That distinction matters because a passkey can be used as a sign-in method later. If an extra passkey is added during a flow that should not allow it, the normal boundary around pending authentication is weakened. This report does not establish that every site using the plugin has been accessed, or that a particular account was changed.
Treat the update as a way to restore the expected login control, not as proof that a compromise occurred. If you are already investigating suspicious administrator activity, use a careful cleanup process such as the guidance for a hacked WordPress site before removing evidence or accounts.
Who is affected
WordPress sites running miniOrange 2FA before version 6.3.1 are affected according to the CVE record. The version number is important: 6.3.1 is the fix, so update to 6.3.1 or a later release offered by the plugin publisher.
Start by confirming that the plugin is installed and active. In the WordPress dashboard, open Plugins, search for miniOrange 2FA, and note the installed version. An administrator with WP-CLI access can use:
wp plugin list --format=table
Look for the miniOrange entry and its version. If the site runs several WordPress installations, run the command from each installation directory. A staging site may have a different plugin version and should be reviewed too, especially if it shares users, configuration, or a deployment process with production.
How to check the affected accounts
The useful follow-up is to review which people can sign in and which authenticators they have registered. Begin with Users in the WordPress dashboard and filter for Administrator. Confirm that each administrator belongs to a real person and that their email address is current.
Then use the miniOrange 2FA settings and each affected user's profile page to inspect registered passkeys, where the plugin exposes that information. Ask the account owner to identify the devices or passkeys shown. Remove a passkey that cannot be explained, and have the owner register a known device again after the plugin is current.
Do not assume an unfamiliar label alone proves abuse. Device labels can be confusing, and an account owner may have registered a phone, security key, or computer under a generic name. The concern is a passkey no one can account for, particularly on an administrator account or alongside other signs such as unknown users. Our guide to finding hidden WordPress admin users can help with that separate check.
What to do now
Update miniOrange 2FA from the dashboard, or use WP-CLI after taking a backup and checking the plugin slug in wp plugin list. A typical update command is:
wp plugin update <plugin-slug>
Replace <plugin-slug> with the exact slug reported on that site. Do not copy a guessed slug into a production command. Confirm the result with wp plugin list --format=table, then test a normal user login and the site's intended two-factor flow.
After the update, review registered passkeys for privileged accounts, remove unrecognized entries, and reset credentials if your investigation finds signs of unauthorized access. Password resets, admin-user review, and plugin updates are complementary steps. Removing one questionable passkey does not address an old password, an unknown administrator, or a separate vulnerable plugin.
Keep WordPress core, themes, and plugins current as part of a scheduled process. The WordPress hardening checklist is a practical place to track updates, account review, and backup checks. If a site has had repeated account problems, a broader security review can identify configuration and access issues beyond this one plugin.
When to get help
Get help if you find an unknown administrator, a passkey that no owner recognizes, login activity you cannot explain, or a site that cannot be updated safely. West Oakbridge's WordPress malware removal service is available for suspected compromise, and its WordPress hardening service can help with follow-up controls.