The 9.8 CVSS on this miniOrange OTP verification plugin paired with an EPSS of only 0.00331 creates a classic disconnect that demands prioritization discipline, not panic. The gap likely reflects narrow exploitability—reaching the privilege escalation path probably requires specific conditions (a particular AJAX endpoint, a session state sequence, or a logic error in role assignment that automated scanners can't easily fingerprint)—rather than pure threat intelligence lag. Treat the CVSS as a capacity statement: if exploited, the impact is catastrophic (unauthenticated creation of administrator accounts, effectively full site compromise). Treat the EPSS as a timing statement: automated exploitation isn't imminent, giving you a remediation window that enterprise software rarely provides.
Your priority list: First, confirm whether auto-updates are active for this plugin and force an update if not—this vendor has a recognizable pattern in authentication-adjacent code, and treating this as an isolated incident misses the structural signal. Second, audit for other miniOrange plugins on the same installation; if this vendor's OTP code contains a privilege escalation flaw, their other security-related plugins warrant scrutiny under the assumption of shared authorial patterns. Third, recognize that the 'unauthenticated' label means this vulnerability has been passively exploitable since introduction—it didn't emerge from complexity, it survived through neglect. The code path was always reachable, waiting.
The WordPress plugin ecosystem creates a specific failure mode: developers who lack cryptographic expertise explicitly delegate authentication to third-party plugins, making the trust boundary entirely dependent on the plugin vendor's development maturity. When that vendor produces a 9.8 flaw in their security-specific product, the blast radius extends beyond the WordPress installation—admin access means plugin installation, theme editing, database access, and often credential exposure for adjacent systems (WooCommerce, CRMs, membership platforms). A successful exploit doesn't just pwn the site; it often compromises the business operation running on it.
Plan for a 6-18 month disclosed-but-unfixed baseline. Not because patches won't be available, but because WordPress plugin remediation follows a distribution curve: some sites update immediately, managed hosts add delays, custom configurations often never update without manual intervention. The vulnerability 'grows' during this window as sites accumulate new configurations, plugin interactions, and access patterns that widen cascade potential. Your risk isn't static between disclosure and patch—it's actively compounding. Treat this as a systemic debt event: the 9.8 already documents future exposure, not just present risk.