miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.9.0 - Unauthenticated Authentication Bypass via Social Login Account Linking
- ID
- WPSEC-2026-0217
- Plugin
- Social Login, Social Sharing by miniOrange (miniorange-login-openid)
- Affected
- all versions before 7.9.1
- Remediation
- Update to 7.9.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) on WPSec AttackSurface
- Fix released
- Published
Description
The Social Login, Social Sharing by miniOrange plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.9.0. This is due to the social login handler automatically linking a social identity to an existing WordPress account whose email matches the address returned by the social provider, and logging that user in immediately without verifying ownership of the email. This makes it possible for unauthenticated attackers who control a social account reporting a victim's email address, for example with a provider that does not verify emails, to log in as any user including administrators.
References
- https://wpsec.com/vuln/WPSEC-2026-0217/
- https://plugins.svn.wordpress.org/miniorange-login-openid/tags/7.9.1/
- https://wordpress.org/plugins/miniorange-login-openid/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS