miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator) Security & Risk Analysis

The plugin "miniorange-2-factor-authentication" v6.2.3 exhibits a mixed security posture. On the positive side, it demonstrates good practices such as a high percentage of SQL queries using prepared statements and a strong emphasis on output escaping, with 96% of outputs properly escaped. The plugin also has a robust system of nonce and capability checks, indicating an effort to secure its functionalities. However, there are significant concerns highlighted by the static analysis and vulnerability history.

The static analysis reveals a notable concern with one REST API route lacking permission callbacks, presenting a direct entry point for unauthorized access. While no critical or high severity taint flows were identified, the presence of four flows with unsanitized paths is a red flag, potentially leading to vulnerabilities if not carefully handled. The code also utilizes the dangerous 'assert' function 46 times, which can be a security risk if not properly managed.

The plugin's historical vulnerability record is a major concern, with a total of 10 known CVEs, including 4 high-severity ones. Although none are currently unpatched, the prevalence of past vulnerabilities such as Exposure of Sensitive Information, CSRF, Missing Authorization, and XSS suggests recurring security weaknesses in the plugin's development or maintenance. The most recent vulnerability being in August 2025 is concerning for a current version. The overall picture is a plugin with some strong security implementations but burdened by a history of serious vulnerabilities and a few clear static analysis weaknesses.