miniOrange OTP Login, Verification and SMS Notifications

78 Quality Score

Active Installs

17/30

With 5,000 active installs it is a mid-tier plugin in this category, well behind general-purpose login form plugins that exceed 20,000 installs.

Update Freshness

25/25

The score is at the maximum because the plugin was updated within the last week relative to the data snapshot, signalling active development.

User Rating

14/15

A 94 out of 100 from 436 reviewers is an excellent satisfaction signal, and the ratio of ratings to installs is healthy.

Support Health

8/15

Support health is weak: 0 public threads and 0 resolutions in the WordPress.org forum suggests users are either not posting publicly or are being funnelled to paid support channels.

WP Compatibility

15/15

Full marks here, as the plugin is tested against WordPress 7.0, supports PHP 5.3.0 and up, and covers all current major WordPress versions in practice.

Scores higher than 66% of indexed plugins

About

OTP Verification via Email/SMS/WhatsApp,SMS Notifications for WooCommerce,OTP Login with Phone,PasswordLess Login.Custom Gateway for OTP Verification

Active Installs 5k+

Rating ★★★★½ 4.7/5

Last Updated 2026-09-09 5:20am GMT

Requires WordPress 4.7.0+

Tested Up To 7.1

Requires PHP 5.3.0+

Security History

5 known vulnerabilities, all patched

4 Critical 1 High

Most recent: September 26, 2026

View details ▸

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter Critical

September 26, 2026 Patched in ["5.5.6"] CVE-2026-85984

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Unauthenticated Privilege Escalation Critical

August 11, 2026 Patched in ["5.5.2"] CVE-2026-61967

miniorange otp verification <= 5.5.1 - Unauthenticated Stored Cross-Site Scripting High

July 27, 2026 Patched in ["5.5.2"] CVE-2026-61957

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter Critical

July 8, 2026 Patched in ["5.5.2"] CVE-2026-14245

miniOrange OTP Login, Verification and SMS Notifications <= 5.4.9 - Unauthenticated Privilege Escalation Critical

May 24, 2026 Patched in ["5.5.0"] CVE-2026-42731

What It Does

miniOrange OTP Login, Verification and SMS Notifications adds one-time password authentication to your WordPress or WooCommerce site via email, SMS, or WhatsApp. It covers passwordless login, phone number verification for new users, and transactional SMS alerts for WooCommerce orders and events. The plugin also exposes a custom gateway API so developers can wire OTP checks into other flows.

Who It's For

This plugin is a fit for WooCommerce store owners who want to verify customer phone numbers, send order SMS notifications, and reduce fake signups without building a custom solution. It also suits membership or community sites that need phone-based or WhatsApp-based login instead of (or in addition to) passwords. Sites in regions where SMS or WhatsApp is the dominant verification channel will get the most value.

Who Should Skip It

If you only need basic two-factor authentication for admin accounts, Google Authenticator or a similar TOTP plugin is lighter and free of telecom dependencies. Small blogs or brochure sites that do not collect user data or process orders have no reason to add OTP friction to the login flow.

The Bottom Line

miniOrange OTP is a capable, frequently updated OTP and SMS notification plugin with strong user satisfaction, but the near-zero public support footprint and the reliance on third-party SMS or WhatsApp gateways mean real costs and support will likely come from miniOrange directly rather than the community. It is a good fit for WooCommerce stores that want phone verification and order SMS, and less compelling for users who only need 2FA or who want a free, community-supported solution.

Related Plugins

Pick this when your main need is replacing the default WooCommerce login and registration forms with nicer UI, and OTP is not a priority.

Google Authenticator 80/100

Choose this if you only need TOTP-based two-factor for admin or user logins, without SMS costs, phone collection, or WooCommerce notification flows.

Customer Email Verification for WooCommerce 80/100

Pick this if you only need to verify customer email addresses before allowing checkout, and do not need phone or SMS features.

User Verification by PickPlugins 78/100

Choose this when you want a free, lightweight email verification workflow for registrations and do not need SMS, WhatsApp, or WooCommerce order notifications.

WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce 77/100

Pick this if you primarily want a broad SMS and MMS notification platform for WooCommerce with optional OTP and 2FA layered on top.