The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeov…

CVE-2026-14245 is a critical authentication bypass vulnerability in the miniOrange OTP Login, Verification and SMS Notifications WordPress plugin affecting all versions up to and including 5.5.1. The flaw exists in the `um_reset_password_process_hook()` function, which performs no server-side verification that an OTP validation step was completed. The plugin exposes a public `form_nonce` nonce to unauthenticated visitors and accepts an attacker-controlled `username_b` parameter, allowing targeting of any WordPress user including administrators. An unauthenticated attacker can obtain a freshly generated password-reset URL for any administrator account via a 302 Location header redirect, leading to full account takeover. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin not configured for phone-only reset. No authentication or prior session binding is required to exploit this vulnerability.