PT-2026-43643 · Miniorange · Miniorange Otp Verification

Peng Zhou · CVE-2026-42731 · Published 2026-05-27 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions miniorange otp verification versions prior to 5.4.10

Description An incorrect privilege assignment issue allows for privilege escalation within the software.

Recommendations Update to a version later than 5.4.9.

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2026-42731

Affected Products

Miniorange Otp Verification

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-42731 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/miniorange-otp-verification/vulnerability/wordpress-miniorange-otp-verification-plugin-5-4-9-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/2059762146817249652 · Twitter Post