Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.