WordPress OTP Plugin Authentication Bypass to Admin Takeover

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account — returned in a 302 `Location` header — and use it to take full control of that account. Exploitation requires the Ultimate Member Password

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The miniOrange OTP Login plugin for WordPress contains a critical authentication bypass vulnerability that allows attackers to reset administrator passwords without completing the required OTP verification step. The vulnerability stems from the `um_reset_password_process_hook()` function relying solely on a predictable public nonce (`moumprvar`) that is emitted to unauthenticated visitors via JavaScript, rather than performing server-side validation that the OTP challenge was actually completed. This affects all versions up to 5.5.1 and enables complete account takeover of WordPress administrators, giving attackers full control over affected websites. With a CVSS score of 9.8 (critical), this vulnerability poses an immediate and severe risk to any WordPress installation using this widely-deployed authentication plugin.

Casky's 283 matching skills leverage Claude AI with extended reasoning to detect the attack patterns behind this vulnerability across two critical MITRE ATT&ACK techniques: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection findings focused on suspicious password reset requests that bypass OTP validation workflows, unauthorized nonce reuse patterns from public JavaScript sources, and attempts to escalate from unauthenticated access to administrative privileges without completing multi-factor authentication. The platform's skills would flag anomalous authentication sequences where OTP steps are skipped, identify exploitation attempts that abuse the predictable nonce emission to unauthenticated users, and correlate these indicators with subsequent administrative account modifications—surfacing the complete attack chain from initial access through privilege escalation in a single consolidated finding.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14245.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-14245

Casky has 283 skills that investigate the attack patterns behind CVE-2026-14245. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn