What is GHSA-vfpr-3q2h-v432?

GHSA-vfpr-3q2h-v432 is a security advisory published by GitHub Security Advisories with Critical severity. The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3...

Which CVE IDs does GHSA-vfpr-3q2h-v432 cover?

GHSA-vfpr-3q2h-v432 covers the following CVE IDs: CVE-2026-77770. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vfpr-3q2h-v432?

GHSA-vfpr-3q2h-v432 has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

GHSA-vfpr-3q2h-v432CriticalCVSS 10.0

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3...

Vendor

GitHub Security Advisories

Published

September 10, 2026

Last Modified

September 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-77770 →

📋 Description

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-77770
https://wpscan.com/vulnerability/68bc7294-1ee6-44a9-9995-3b23b921f750
https://github.com/advisories/GHSA-vfpr-3q2h-v432