Skip to content
PluginCanary

miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)

by miniOrange · 10,000+ active installs · Checked 3 Nov 2026
Healthy3 Warnings

Healthy: vulnerability published 19 Oct 2026, fixed in 6.3.1.

83/ 100 Canary Score
Sub-scores for miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
Ownership100
Maintenance100
Security60
Support70
Reputation85

How the score works

Active signals

Facts we detected, with links to the source.

  • WarningSEC-1Vulnerability published 19 Oct 2026, fixed in 6.3.1. Update to version 6.3.1 or later.19 Oct 2026Evidence
  • WarningSEC-1Vulnerability published 8 Sep 2026, fixed in 6.3.1. Update to version 6.3.1 or later.8 Sep 2026Evidence
  • WarningSEC-1Vulnerability published 8 Sep 2026, fixed in 6.3.1. Update to version 6.3.1 or later.8 Sep 2026Evidence
  • InfoSEC-38 vulnerabilities published in the last 24 months. Review this plugin.4 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
cyberlord929 Jul 2015 to 7 Oct 2024, 331 commits
twofactorauthentication11 Jun 2021 to 21 Mar 2022, 43 commits
mayurjogale1 Apr 2022 to 25 Apr 2023, 24 commits
miniorangetwofactor21 Apr 2022 to 21 Apr 2022, 1 commits
abhishek99rana23 May 2022 to 2 Jan 2023, 11 commits
prashantbhivsane1 Jun 2022 to 22 Jun 2022, 9 commits
jayeshprajapat1 Jul 2022 to 1 Jul 2022, 2 commits
shrikantniras18 May 2023 to 11 Sep 2024, 23 commits
mowpmfa21 Nov 2024 to 25 Dec 2025, 27 commits
miniorangewp9 Feb 2026 to 2 Nov 2026, 17 commits

10 committers recorded. No ownership changes recorded since 3 Nov 2026.

Maintenance

Last release
2 days ago
Releases, 24 months
30
Tested up to
7.1 current
Requires PHP
5.3.0 supported 8.2+
Releases per quarter for miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
Q1 20242
Q2 20242
Q3 20244
Q4 20241
Q1 20251
Q2 20253
Q3 20255
Q4 20257
Q1 20261
Q2 20262
Q3 20267
Q4 20263

Last release 2 Nov 2026. Tested with WordPress 7.1 (current).

Support

Support history appears after our first snapshots of the forum counts.

Security record

PublishedIssueCVSSAffectedFixed inDays to patch
19 Oct 2026miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.9 - 6.3.0 - Two-Factor Authentication Bypass4.36.2.9 to 6.3.06.3.10
8 Sep 2026miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) 6.2.8 - 6.3.0 - Unauthenticated Second Factor Authentication Bypass5.318.0 to 19.2, 6.2.8 to 6.3.06.3.10
8 Sep 2026miniOrange 2FA – Two Factor Authentication for WordPress 5.3.24 - 6.3.0 - Missing Authorization to Unauthenticated Arbitrary Option Deletion7.318.0 to 19.2, 5.3.24 to 6.3.06.3.10
30 Jul 2026miniOrange 2FA <= 6.2.7 - Two-Factor Authentication Bypass via Brute Force3.1<= 6.2.76.2.80
29 Jul 2026miniOrange 2FA <= 6.2.6 - Two-Factor Authentication Bypass4.3<= 6.2.66.2.70
27 Jul 2026miniOrange 2FA <= 6.2.6 - Missing Authorization4.3<= 6.2.66.2.70
15 Jul 2026miniOrange 2FA – Two Factor Authentication for WordPress (OTP, SMS, Email, Google Authenticator) < 6.2.6 - Two-Factor Authentication Bypass5.3< 6.2.66.2.60
23 Aug 2025miniOrange's Google Authenticator <= 6.1.1 - Missing Authorization4.3<= 6.1.16.1.20
19 Apr 2023miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Change7.5<= 5.6.55.6.60
23 Nov 2022miniOrange's Google Authenticator <= 5.6.1 - Sensitive Data Exposure of Multifactor Backup Codes7.5<= 5.6.15.6.20
1 Nov 2022miniOrange's Google Authenticator <= 5.6.1 - Cross-Site Request Forgery to Malware Scan Termination8.8<= 5.6.15.6.20
31 Oct 2022miniOrange's Google Authenticator <= 5.6.1 - Missing Authorization to Plugin Settings Change5.4<= 5.6.15.6.20
16 Sep 2022miniOrange's Google Authenticator <= 5.5.82 - Missing Authorization6.3<= 5.5.825.6.00
27 Jun 2022miniOrange's Google Authenticator <= 5.5.7 - Reflected Cross-Site Scripting6.1<= 5.5.75.5.750
6 Jun 2022miniOrange's Google Authenticator <= 5.5.5 - Authenticated (Admin+) Cross-Site Scripting5.5<= 5.5.55.5.60
28 Feb 2022miniOrange's Google Authenticator <= 5.4.52 - Unauthenticated Arbitrary Options Deletion8.1<= 5.4.525.50
10 Aug 2021miniOrange's Google Authenticator <= 5.4.39 - Cross-Site Scripting6.1<= 5.4.395.4.400

Source: Wordfence Intelligence.

Reputation

Average rating per quarter for miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
Q2 20242.7
Q3 20244.8
Q4 20245.0
Q1 20255.0
Q2 20254.3
Q4 20255.0
Q1 20265.0
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating rose from 2.7 to 5.0 between Q2 2024 and Q4 2026.

Rating distribution
5 star329
4 star14
3 star2
2 star4
1 star36
Latest low reviews

Momentum

10,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)
4 May 2026537
11 May 2026921
18 May 202610,417
25 May 20262,026
1 Jun 20261,332
8 Jun 20261,093
15 Jun 20261,395
22 Jun 2026763
29 Jun 2026774
6 Jul 202610,140
13 Jul 20262,349
20 Jul 202617,342
27 Jul 20263,187
3 Aug 20261,859
10 Aug 20269,577
17 Aug 20263,365
24 Aug 202610,526
31 Aug 20261,839
7 Sep 202610,909
14 Sep 20262,059
21 Sep 202610,968
28 Sep 202610,191
5 Oct 20262,648
12 Oct 20261,551
19 Oct 202611,224
26 Oct 20262,475
2 Nov 20267,228

Weekly downloads over the last 4 weeks are 9% above the 27-week average.

Healthier alternatives

Same category, higher Canary Score. Never sponsored.

LoginizerScore 93 · 1,000,000+FluentAuth - Login Security, Two-Factor Authentication, Passkeys & Social LoginScore 93 · 10,000+All In One LoginScore 92 · 60,000+WPS Hide LoginScore 91 · 2,000,000+Temporary Login Without PasswordScore 91 · 90,000+

Facts

Version6.6.0
AuthorminiOrange
Added9 Jul 2015
Last updated2 Nov 2026
Active installs10,000+
Requires WordPress5.3.0
Tested up to7.1.4
Requires PHP5.3.0
CategorySecurity & Privacy > Security Scanning & Malware Protection
Tags2FA, MFA, passkey, security, two factor authentication

Other plugins by this author: SAML Single Sign On - SSO Login, Social Login, Social Sharing by miniOrange, JWT Authentication for WP REST APIs, Secure MCP Server for Claude, ChatGPT, Gemini and other AI Agents, OAuth Single Sign On - SSO (OAuth Client), Password Policy Manager, miniOrange OTP Login, Verification and SMS Notifications, Active Directory Integration / LDAP Integration, Custom API for WP, Prevent Files / Folders Access, WP OAuth Server ( Login with WordPress ), Page and Post Restriction

Questions

Is miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) still maintained?

miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) was last updated on 2 Nov 2026. Its Canary status is Healthy.

Is miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) safe?

miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) has no open unpatched vulnerabilities on record. 8 vulnerabilities were published in the last 24 months. Its Canary status is Healthy.

Who owns miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)?

The wordpress.org author is miniOrange. Recent committers: miniorangewp, mowpmfa, cyberlord92, shrikantniras, mayurjogale. We have recorded no ownership change.

What can I use instead of miniOrange 2FA - Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator)?

Plugins in the same category with a higher Canary Score: Loginizer, FluentAuth - Login Security, Two-Factor Authentication, Passkeys & Social Login, All In One Login, WPS Hide Login, Temporary Login Without Password.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews, Wordfence Intelligence.Plugin data refreshed 3 Nov 2026.Report a data issue