miniOrange Social Login CVE-2026-12761

The plugin must be installed and active with its social-login / Profile Completion flow reachable, and the attack targets accounts on installs where the plugin's customer_key option is static or empty (empty on installations never registered with miniOrange, which maximizes crackability). The concrete prerequisites are: the ability to reach the plugin's OTP endpoints and send a POST with an arbitrary 'email_field' value, and knowledge of a target account's email address (an admin address for full takeover). No authentication, no user interaction, and no OAuth provider credentials are required - the flaw is that the provider-verified identity is never enforced. Limiting factors: the attacker must know or guess a valid target email; installs with a strong non-empty customer_key raise the offline cracking cost (though the OTP keyspace remains small); and the vulnerable endpoints must not be blocked by a WAF or the plugin deactivated.

All independent signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) describes a remote, unauthenticated, low-complexity attack with total impact, and the technical description supports every metric: the offline OTP crack removes any meaningful complexity or interaction barrier, so AC:L is well justified rather than optimistic. The outcome is full administrator takeover, which on WordPress equals complete site compromise (plugin/theme editor, PHP execution). EPSS was not provided, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation - this should be treated as pre-exploitation exposure, not an in-the-wild campaign. No public PoC was identified, but the advisory spells out the entire chain, meaning weaponization is low-effort; the practical window between disclosure and exploitation for such plugins is typically short. There is no conflict among the signals; the main missing datum is exploitation-probability (EPSS) and confirmation of the exact fixed version.

An unauthenticated attacker initiates the plugin's social-login Profile Completion flow and submits 'email_field' set to a known administrator address on the target site. The server emails an OTP to that admin and, in the same response, returns the SHA-512(customer_key||otp) transaction hash; the attacker brute-forces the ~99,000-value OTP offline in under a second (customer_key is static or empty), then submits the recovered OTP to mo_openid_social_login_validate_otp() and is logged in as the administrator. No PoC is publicly identified, but the network-facing, low-complexity vector (AV:N/AC:L) makes this straightforward to script.