miniOrange OAuth SSO CVE-2026-28008

Exploitation requires that the vulnerable miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' plugin (<= 7.0.0) be installed and active on an internet-reachable WordPress site with its OAuth/SSO login flow enabled and exposed, so the attacker can reach the plugin's authentication callback. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against such a deployment. The main limiting factors are that the site must actually be running this specific plugin at an affected version with SSO active; the terse advisory does not enumerate whether particular OAuth provider configurations are required, so whether all configurations are exploitable is unconfirmed and should be validated against the vendor/Patchstack advisory.

The signals are largely one-directional toward high risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes fully remote, unauthenticated, low-complexity exploitation yielding complete compromise of confidentiality, integrity and availability, consistent with taking over an administrator account on a WordPress site. Tempering that, no EPSS score was provided in the input, the CVE is not in CISA KEV (so there is no evidence of active exploitation), and no proof-of-concept is referenced - so this is a high-CVSS issue whose real-world exploitation volume is currently unproven rather than a confirmed in-the-wild threat. The precise preconditions are also not spelled out in the terse Patchstack description, so it is not confirmed whether every 7.0.0-or-earlier deployment is affected identically or only certain provider configurations; this should be verified against the vendor/Patchstack advisory. On balance, because authentication-bypass flaws in publicly reachable WordPress login paths are attractive and easily automated once details circulate, defenders should treat CVSS 9.8 plus 'unauthenticated admin takeover' as urgent and patch promptly rather than waiting for a KEV listing.

An attacker who can reach the WordPress site's OAuth login endpoint crafts or manipulates the SSO authentication response so the plugin accepts a spoofed identity, and is logged in as an existing administrator without any valid credentials. From that admin session the attacker installs a malicious plugin or theme to gain code execution and persistent backdoor access to the site. No public proof-of-concept is referenced, but the low-complexity, unauthenticated network vector means exploitation would be straightforward once technical details are known.