miniOrange Social Login CVE-2026-14300

Exploitation requires two concrete, named preconditions that must both be true on the target: the plugin's optional 'Profile Completion' email-verification feature must be enabled, and social login must be configured. The attacker needs no authentication (PR:N) and no user interaction (UI:N), but must be able to receive a one-time code at an email address they control and then replay it against the victim's email address. Limiting factors: sites running the plugin with default settings where Profile Completion is not turned on are not exploitable, and the AC:H rating reflects the dependency on this specific non-default configuration; the attacker must also know or guess the victim's email address (e.g., a known admin address).

This is a genuine authentication-bypass leading to full administrator account takeover (C:H/I:H/A:H), which drives the 8.1 CVSS. However, several signals temper urgency: the CVSS vector marks AC:H, reflecting that exploitation requires two specific non-default preconditions (the Profile Completion feature enabled AND social login configured), and EPSS is only 0.14% (4th percentile), indicating low predicted mass-exploitation. There is no CISA KEV listing, so despite POC availability there is no confirmed active exploitation - do not conflate the two. The realistic verdict: a high-impact, patch-now issue for the subset of sites running this exact configuration, but not a broad internet-wide emergency. The main uncertainty is deployment reach - the specific configuration requirement means many installs of the plugin may not be exploitable, so exposure should be validated per-site rather than assumed from the plugin's presence alone.

An attacker with no account visits a WordPress site running the vulnerable plugin with Profile Completion enabled, initiates the email-verification flow for an attacker-controlled address, and receives a valid one-time code. Because the code is not bound to that email, the attacker replays it while supplying the site administrator's email address and is issued an authenticated admin session. Publicly available exploit code (WPScan) lowers the practical bar, though the AC:H rating reflects the required non-default feature configuration.