---
id: 6554
title: "CVE-2026-61967 — miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypass"
cve: CVE-2026-61967
vendor: "miniOrange"
product: "OTP Verification plugin for WordPress"
affected_versions: "5.5.1 and earlier; fixed in 5.5.2"
source_domain: aretiq.ai
source_url: "https://aretiq.ai/research/vul260815-cve-2026-61967-miniorange-otp-verification-ultimate-member-password-reset-authentication-bypass/"
published_at: "2026-08-15T00:00:00Z"
tags: ["ai-security", "authentication-bypass", "wordpress", "authentication", "vulnerability", "cve", "password-reset", "miniorange", "cve-2026-61967", "otp"]
phying_url: "https://phying.com/item/6554"
lang: en
---

# CVE-2026-61967 — miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypass

## Summary

Aretiq analyzes CVE-2026-61967: miniOrange's OTP Verification plugin (≤5.5.1) skips OTP checks in Ultimate Member's password reset, letting unauthenticated attackers reset any account's password.

## Why it matters

This research provides technical context that security teams can use for monitoring and validation.

## Intelligence Metadata

- **Sources:** aretiq.ai
- **CVE:** CVE-2026-61967
- **Vendor:** miniOrange
- **Product:** OTP Verification plugin for WordPress
- **Affected versions:** 5.5.1 and earlier; fixed in 5.5.2
- **Published:** 2026-08-15T00:00:00Z
- **Original:** https://aretiq.ai/research/vul260815-cve-2026-61967-miniorange-otp-verification-ultimate-member-password-reset-authentication-bypass/
- **Phying News:** https://phying.com/item/6554