Unauthenticated WordPress Option Deletion in miniOrange 2FA

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every administrator out of the dashboard or deactivate every miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 on the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-77770 is a critical authentication bypass vulnerability in the miniOrange 2FA WordPress plugin that allows any unauthenticated visitor to delete arbitrary site options through unvalidated user input. The vulnerability stems from missing transaction validation and improper authorization checks, enabling attackers to remove essential WordPress options without requiring admin credentials. This affects all installations running miniOrange 2FA versions before 6.3.1 and 19.3, making it a high-impact threat to WordPress sites relying on this authentication plugin. Attackers can exploit this to lock administrators out of the dashboard entirely or disable the 2FA plugin itself, essentially gaining functional control over site access and security posture.

Casky's 283 mapped skills detect the attack patterns behind this CVE by analyzing indicators across MITRE ATT&CK's Privilege Escalation (TA0004) and Persistence (TA0006) techniques. Practitioners using Casky would observe findings related to unauthorized option manipulation, missing input validation checks, and broken access control patterns. The platform's extended reasoning capabilities would flag suspicious HTTP requests with crafted parameters targeting WordPress option deletion endpoints, lack of nonce verification in plugin code, and absence of capability checks before sensitive operations. Security teams would see detection patterns highlighting how unauthenticated requests successfully modify site configuration, the lateral movement potential when admin lockout occurs, and persistence achieved through disabled security controls—enabling practitioners to identify compromised sites and trace exploitation attempts back to their origins.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-77770.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-77770

Casky has 283 skills that investigate the attack patterns behind CVE-2026-77770. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn