CVE-2022-4943
miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenticated attackers to change the plugin's settings.
| CWE | CWE-862 |
| Vendor | cyberlord92 |
| Product | miniorange 2fa – two-factor authentication for wordpress (sms, email & google authenticator) |
| Published | Oct 20, 2023 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for cyberlord92 miniorange 2fa – two-factor authentication for wordpress (sms, email & google authenticator)
Be the first to know when new high vulnerabilities affecting cyberlord92 miniorange 2fa – two-factor authentication for wordpress (sms, email & google authenticator) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
cyberlord92 / miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)
0 ≤ 5.6.5
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/7267ede1-7745-47cc-ac0d-4362140b4c23?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2842228%40miniorange-2-factor-authentication%2Ftrunk&old=2815645%40miniorange-2-factor-authentication%2Ftrunk&sfp_email=&sfph_mail=
Credits
Ramuel Gall