What is the CVSS score of CVE-2026-28008?

CVE-2026-28008 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of miniOrange OAuth SSO are affected by CVE-2026-28008?

The miniOrange OAuth SSO WordPress plugin (versions 7.0.0 and earlier) contains a critical authentication bypass that allows unauthenticated attackers to gain unauthorized account access, including…

How to fix or mitigate CVE-2026-28008?

Within 24 hours, immediately disable the miniOrange OAuth SSO plugin on all affected WordPress instances (version 7.0.0 and earlier) and review authentication logs for suspicious login patterns. Within 7 days, deploy an alternative authentication mechanism-either revert to standard WordPress authentication or implement a different OAuth provider-and audit all administrator and user account changes during the vulnerability window for unauthorized modifications. Within 30 days, subscribe to miniOrange security advisories for patch availability (watch for version 7.0.1 or later), apply the patch across all instances upon release, and conduct a full access review of accounts accessed during exposure.

miniOrange OAuth SSO CVE-2026-28008

EUVD-2026-57944 CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-08-13 Patchstack

GHSA-mf9c-gfqh-h78j

WordPress Authentication Bypass Wordpress Plugin Oauth Single Sign On Sso Oauth Client Miniorange

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable authentication bypass (CWE-290) grants administrator access, so PR:N/UI:N/AC:L with full C/I/A impact via account takeover.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:59 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Broken Authentication in OAuth Single Sign On - SSO (OAuth Client) <= 7.0.0 versions.

AnalysisAI

Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target.

Technical ContextAI

The affected component is a WordPress authentication plugin that acts as an OAuth 2.0 / OpenID Connect client, delegating login to external identity providers (Google, Facebook, EVE Online and other configurable OAuth endpoints) and then mapping the returned identity to a local WordPress account. The CPE 'cpe:2.3:a:miniorange:oauth_single_sign_on_-_sso_(oauth_client)' confirms the vendor is miniOrange and the product is their OAuth client plugin. CWE-290 (Authentication Bypass by Spoofing) indicates the root cause is that the plugin trusts an identity assertion without adequately verifying it - for OAuth clients this class of flaw typically stems from missing or improper validation of the token, signature, issuer, audience, state/nonce, or the binding between the provider response and the local account, allowing a forged or replayed identity to be accepted as genuine.

RemediationAI

Upgrade the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' plugin to the fixed release published by the vendor for versions above 7.0.0; because the input does not contain an exact patched version number, no vendor-released patch version is independently confirmed here, so verify the current fixed version on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-0-0-broken-authentication-vulnerability) and the plugin's WordPress.org page before deploying. If you cannot update immediately, compensating controls include temporarily deactivating the OAuth SSO plugin and reverting affected roles to standard WordPress authentication (trade-off: SSO logins break for legitimate users), restricting access to wp-login.php and the plugin's OAuth callback endpoints via WAF rules or IP allow-listing (trade-off: may block legitimate external IdP redirects), and auditing existing administrator/user accounts and active sessions for unexpected additions or logins in case exploitation has already occurred. Enforce strong MFA on any remaining admin accounts as an additional barrier.