Security readout for executives and security teams
Plain-English summary
This WordPress 2FA plugin flaw could let an unauthenticated attacker change miniOrange Google Authenticator settings. That is serious because weakening or altering 2FA controls can undermine account protection across a site. The provided sources do not show active exploitation.
Executive priority
Treat as a near-term security maintenance item for any WordPress property using this plugin. It affects the integrity of authentication controls, but the sources do not support emergency active-exploitation status.
Technical view
CVE-2022-4943 is a missing authorization check in miniOrange 2FA / Google Authenticator for WordPress through version 5.6.5. The CVSS 3.1 score is 7.5, with network access, low complexity, no privileges, no user interaction, and high integrity impact.
Likely exposure
Exposure is most likely on WordPress sites running the miniOrange 2FA plugin at version 5.6.5 or earlier, especially internet-facing sites where unauthenticated requests can reach WordPress plugin functionality.
Exploitation context
The bundle marks KEV as false, and no provided source states active exploitation. The risk remains material because the weakness is unauthenticated, remotely reachable, low complexity, and affects security-control settings.
Researcher notes
The primary weakness is CWE-862 missing authorization. The source bundle identifies vulnerable versions through 5.6.5 and references a WordPress Trac changeset, but it does not provide enough detail here to assert exploit activity or exact fixed-version metadata.
Mitigation direction
- Inventory WordPress sites for the miniOrange 2FA plugin and version.
- Upgrade beyond 5.6.5 where vendor guidance confirms a fixed release.
- Check Wordfence and WordPress plugin guidance before choosing compensating controls.
- Review plugin 2FA settings for unauthorized or unexpected changes.
- Disable or remove the plugin if it is unused or cannot be updated.
Validation and detection
- Confirm no production WordPress site runs miniOrange 2FA version 5.6.5 or earlier.
- Verify current plugin settings match approved 2FA policy.
- Review administrative audit logs for unexpected plugin setting changes.
- Check WordPress plugin changelog or vendor advisory for the fixed version.
- Confirm compensating controls do not rely solely on this plugin.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-4943 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7267ede1-7745-47cc-ac0d-4362140b4c23?source=cveCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2842228%40miniorange-2-factor-authentication%2Ftrunk&old=2815645%40miniorange-2-factor-authentication%2Ftrunk&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.