What is the CVSS score of CVE-2026-14300?

CVE-2026-14300 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of miniOrange Social Login are affected by CVE-2026-14300?

The miniOrange Social Login WordPress plugin (versions before 7.8.0) contains a critical authentication bypass enabling account takeover of any user account, including administrators, without valid…. A patch is available.

Is there a public PoC exploit available for CVE-2026-14300?

Yes, a public proof-of-concept exploit is available for CVE-2026-14300. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14300?

Within 24 hours: Identify all WordPress installations running miniOrange Social Login plugin versions prior to 7.8.0 and verify backup procedures are current and accessible. Within 7 days: Deploy vendor-released patch version 7.8.0 to test and staging environments first to validate plugin functionality, then roll out to production systems in phases to minimize operational disruption. Within 30 days: Confirm all instances are updated to version 7.8.0 or later, audit authentication logs for evidence of exploitation during the vulnerability window, and review account access for high-privilege accounts for unauthorized administrative activity.

miniOrange Social Login CVE-2026-14300

EUVD-2026-50121 HIGH

Improper Authentication (CWE-287)

2026-07-29 WPScan

GHSA-6xgh-57mv-pxm7

WordPress Authentication Bypass Google Miniorange Social Login And Register Discord Google Twitter Linkedin Unknown

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network attack (AV:N/PR:N) but AC:H because it depends on the non-default Profile Completion feature and social-login config; admin takeover yields full C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:34 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

8.1 (HIGH)

Patch available

Jul 29, 2026 - 07:01 EUVD

CVE Published

Jul 29, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Jul 29, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

AnalysisAI

Account takeover in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 lets unauthenticated attackers hijack any account, including administrators. The optional email-verification one-time code is not bound to the account it was issued for, so an attacker requests a code for an email they control and replays it against a victim's email to obtain a valid session. Publicly available exploit code exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.

Technical ContextAI

The vulnerability sits in the plugin's 'Profile Completion' email-verification workflow, which issues a one-time code (OTC) during social-login-driven registration to confirm a user's email address. Classed as CWE-287 (Improper Authentication), the root cause is a missing binding between the issued code and the specific account/email it was generated for - the server validates that a submitted code is valid but not that it was issued for the email being verified. This turns a verification step into an authentication oracle. The affected component is the WordPress plugin identified by CPE cpe:2.3:a:unknown:miniorange_social_login_and_register_(discord,_google,_twitter,_linkedin), a third-party OAuth/social-login integration layer that federates identities from Google, Discord, Twitter, and LinkedIn into WordPress user sessions.

RemediationAI

Vendor-released patch: upgrade the miniOrange Social Login and Register plugin to version 7.8.0 or later, which binds the one-time code to the issuing account. If immediate patching is not possible, the most direct compensating control is to disable the Profile Completion email-verification feature, which removes the vulnerable code path (trade-off: users completing social registration will no longer be prompted to verify/complete their email profile); alternatively, temporarily disabling social login entirely also eliminates the attack surface but breaks all federated login flows. As a defensive measure, audit for recently created or elevated administrator accounts and force session/password resets for privileged users, since successful exploitation yields a valid session rather than a credential change. Reference the WPScan advisory at https://wpscan.com/vulnerability/7ecf657b-b059-4420-8c36-f38d58960d2b/ for confirmation of the fixed version.