CVE-2025-54745: 
WordPress vulnerability analysis and mitigation

CVE-2025-54745 is a Missing Authorization (Broken Access Control) vulnerability in the miniOrange's Google Authenticator WordPress plugin (miniorange-2-factor-authentication). It affects all versions up to and including 6.1.1, and was discovered by Ananda Dhakal of Patchstack, reported on July 24, 2025, and published on August 23, 2025. The vulnerability allows authenticated attackers with low privileges (Subscriber-level) to exploit incorrectly configured access control security levels. It carries a CVSS v3.1 base score of 6.5 (Medium) (Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing privileged actions. This is a network-based attack requiring low privileges (e.g., a Subscriber account) and no user interaction, making it straightforward to exploit once an attacker has any authenticated foothold on the WordPress site. The flaw falls under OWASP Top 10 category A1: Broken Access Control, where insufficient authorization checks allow lower-privileged users to perform actions reserved for higher-privileged roles (Patchstack).

Successful exploitation allows a low-privileged authenticated user (e.g., a Subscriber) to perform unauthorized actions that should be restricted to higher-privileged roles, resulting in a high integrity impact. While confidentiality and availability are not directly affected per the CVSS scoring, an attacker could potentially manipulate the plugin's two-factor authentication settings, which could undermine the security posture of the entire WordPress site by weakening or disabling MFA protections for other accounts (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.022% (0.000220), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity, suggesting elevated risk over time (Patchstack).

1. Reconnaissance: Identify WordPress sites running the miniOrange's Google Authenticator plugin version 6.1.1 or earlier using tools like WPScan, Shodan, or by inspecting plugin directories.
2. Obtain low-privilege access: Register or obtain credentials for a low-privileged account (e.g., Subscriber) on the target WordPress site.
3. Identify vulnerable endpoints: Enumerate plugin-specific AJAX actions or admin endpoints that lack proper authorization checks within the miniorange-2-factor-authentication plugin.
4. Send unauthorized request: Craft and send an authenticated HTTP request (with Subscriber-level session cookies/nonce) to a restricted plugin function — such as modifying 2FA settings — that should require Administrator-level privileges.
5. Achieve unauthorized action: The missing authorization check allows the request to succeed, enabling the attacker to alter plugin configuration, potentially disabling or weakening two-factor authentication for targeted accounts (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or plugin-specific endpoints from Subscriber-level accounts, particularly targeting miniOrange plugin actions.
• Logs: Unexpected changes to plugin settings recorded in WordPress activity logs (if an audit plugin is installed), especially modifications to 2FA configuration by non-administrator users.
• File System: Unexpected changes to the miniOrange plugin configuration files or database options table entries (wp_options) related to miniorange_2fa_* keys.
• Network: Repeated authenticated requests from the same low-privilege user account to plugin admin endpoints in a short time window, indicative of automated exploitation attempts.

The vendor has released version 6.1.2 of the miniOrange's Google Authenticator plugin, which patches this vulnerability. Site administrators should update to version 6.1.2 or later immediately via the WordPress plugin dashboard. Patchstack users benefit from an automatically deployed virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. If immediate updating is not possible, consider temporarily deactivating the plugin or restricting site registration to prevent attackers from obtaining low-privilege accounts (Patchstack).