What is the CVSS score of CVE-2026-12761?

CVE-2026-12761 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of miniOrange Social Login are affected by CVE-2026-12761?

The miniOrange Social Login WordPress plugin (through version 7.7.0) contains a critical authentication bypass allowing unauthenticated attackers to compromise any user account, including…

How to fix or mitigate CVE-2026-12761?

24 hours: Inventory all WordPress installations running miniOrange Social Login plugin version 7.7.0 or earlier; disable the plugin immediately as containment; monitor administrative accounts for suspicious login attempts. 7 days: Contact miniOrange for patch timeline; if social authentication is business-critical, deploy alternative OAuth provider from different vendor; conduct forensic review of authentication logs for past 30 days to identify unauthorized access. 30 days: Upon vendor patch release, update miniOrange Social Login to patched version; restore plugin; conduct account security audit and rotate administrative credentials.

miniOrange Social Login CVE-2026-12761

EUVD-2026-43026 CRITICAL

Improper Authentication (CWE-287)

2026-07-10 Wordfence

GHSA-6rhq-rx45-fhhp

WordPress Authentication Bypass Google Wordpress Plugin Miniorange Social Login And Register Discord Google Twitter Linkedin Cyberlord92

9.8

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Remote unauthenticated (AV:N/PR:N/UI:N); offline OTP crack in under a second keeps AC:L; admin takeover yields full C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 21:29 vuln.today

CVE Published

Jul 10, 2026 - 20:31 nvd

CRITICAL 9.8

DescriptionCVE.org

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied - granting full administrator access.

Articles & Coverage 1

News Critical Authentication Bypass in miniOrange Social Login WordPress Plugin - CVE-2026-12761 Jul 11, 2026

AnalysisAI

Authentication bypass in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin through version 7.7.0 lets unauthenticated attackers seize any account, including administrators. The Profile Completion flow trusts an attacker-supplied 'email_field' POST value without confirming it matches the OAuth provider's verified identity, and the send_otp_token() routine leaks a SHA-512(customer_key||otp) hash to the client where the OTP is one of only 99,000 values and customer_key is a static (often empty) option - so the OTP can be brute-forced offline in under a second. Rated CVSS 9.8; no public exploit identified at time of analysis, but the full attack primitive is described in the Wordfence advisory.

Technical ContextAI

The affected component is a WordPress social-login plugin (cpe:2.3:a:cyberlord92:miniorange_social_login_and_register...) that federates identity from OAuth providers such as Google, Discord, Twitter and LinkedIn. The root cause is CWE-287 (Improper Authentication): after an OAuth round-trip the Profile Completion handler (mo_openid_prof_comp_funct.php) accepts an arbitrary 'email_field' rather than binding the session to the email asserted by the provider, breaking the trust chain between the OAuth assertion and the local account. Compounding this, send_otp_token() (mo-openid-social-login-functions.php) returns the server-side verification hash SHA-512(customer_key || otp) to the browser. Because the OTP is generated with wp_rand(1000, 99999) - an effective keyspace of roughly 99,000 candidates - and customer_key is a static plugin option that is empty on installs never registered with miniOrange, the leaked hash is trivially reversible offline, defeating the OTP as a second factor and letting mo_openid_social_login_validate_otp() authenticate the attacker as the supplied email's owner.

RemediationAI

Upstream fix available (changeset 3592642); a released patched version above 7.7.0 is referenced by the vendor's SVN commit but the exact tagged release is not independently confirmed in the provided data - update the plugin to the latest available version from the WordPress.org repository and verify it is newer than 7.7.0, consulting the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a56b59ce-29c2-4172-b703-a06d7bb28da0) and the changeset (https://plugins.trac.wordpress.org/changeset/3592642/) for the fixed version number. If immediate patching is not possible, the highest-value compensating control is to deactivate the miniOrange Social Login plugin entirely, which stops the vulnerable Profile Completion and OTP endpoints but disables social login for users; alternatively, block or restrict access to the plugin's AJAX/login action endpoints (the mo_openid social-login and OTP-validation actions) at a WAF or reverse proxy, accepting that overly broad rules may break legitimate OAuth callbacks. Deploying a virtual patch via a WordPress firewall (e.g. Wordfence) that filters requests supplying attacker-controlled 'email_field' values reduces exposure without removing functionality. After patching, audit administrator and user accounts for unexpected additions or logins and rotate credentials, since exploitation leaves the attacker with a legitimate authenticated session.