A privilege escalation vulnerability (CVE-2026-42731) has been identified in the miniOrange OTP Verification WordPress plugin. The vulnerability is classified as an Incorrect Privilege Assignment issue that allows attackers to escalate privileges. The vulnerability affects all versions of the miniorange-otp-verification plugin from the initial release through version 5.4.9. This represents a significant security risk for WordPress sites using this authentication plugin. Users should update to a patched version immediately to prevent potential privilege escalation attacks.