https://aretiq.ai/tags/ultimate-member/Recent content in Ultimate-Member on Aretiq AIHugoen-usSat, 15 Aug 2026 00:00:00 +0000https://aretiq.ai/research/vul260815-cve-2026-61967-miniorange-otp-verification-ultimate-member-password-reset-authentication-bypass/Sat, 15 Aug 2026 00:00:00 +0000https://aretiq.ai/research/vul260815-cve-2026-61967-miniorange-otp-verification-ultimate-member-password-reset-authentication-bypass/<h1 id="cve-2026-61967--miniorange-otp-verification-ultimate-member-password-reset-authentication-bypass">CVE-2026-61967 — miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypass</h1> <h2 id="1-overview">1. Overview</h2> <p>A vulnerability exists in the miniOrange OTP Verification plugin for WordPress (versions 5.5.1 and earlier) that allows an unauthenticated attacker to bypass OTP verification during the Ultimate Member password reset flow. The plugin&rsquo;s <code>um_reset_password_process_hook</code> handler processes password reset requests without checking whether the required OTP was actually validated, relying solely on a publicly available WordPress nonce for authorization. An attacker can submit the password reset form for any user account, including administrators, and receive a valid password reset URL in the HTTP response, enabling full account takeover without any OTP or credential. The vendor addressed this vulnerability in version 5.5.2 by adding OTP session validation and username integrity checks.</p>