What is the CVSS score of CVE-2026-57807?

CVE-2026-57807 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of miniOrange OAuth SSO are affected by CVE-2026-57807?

A critical authentication bypass in miniOrange OAuth SSO WordPress plugin (versions ≤38.5.8) allows unauthenticated attackers to gain arbitrary account access, including administrator privileges, via…

How to fix or mitigate CVE-2026-57807?

Within 24 hours: Audit all WordPress instances for miniOrange OAuth SSO plugin presence and versions; compile inventory by criticality. Within 7 days: Disable the plugin on non-production systems; implement compensating controls (see below) on production instances; contact miniOrange support for patch timeline and escalate to incident response if unauthorized access is detected. Within 30 days: Apply vendor patch immediately upon release or migrate to alternative OAuth provider; rotate all admin and service account credentials; review login audit logs from past 90 days for exploitation indicators.

miniOrange OAuth SSO CVE-2026-57807

EUVD-2026-43028 CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-10 Patchstack

GHSA-x77p-gjm6-3v9r

WordPress Authentication Bypass Wordpress Plugin Oauth Single Sign On Sso Oauth Client

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable auth bypass (AV:N/AC:L/PR:N/UI:N) yielding administrator takeover gives full control of the site, so C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 21:31 vuln.today

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation.

This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.

AnalysisAI

Authentication bypass in the miniOrange OAuth Single Sign On - SSO (OAuth Client) WordPress plugin (versions up to and including 38.5.8) lets remote unauthenticated attackers abuse an alternate authentication path in the password-recovery flow to log in as arbitrary users, including administrators. Rated CVSS 9.8, the flaw grants full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis, but the plugin's SSO role and low attack complexity make it a high-value target.

Technical ContextAI

The affected component is a WordPress plugin that acts as an OAuth 2.0 / OpenID Connect client, allowing WordPress sites to delegate login to external identity providers (Google, Azure AD, Okta, Keycloak, etc.). The vulnerability is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel: the plugin exposes a secondary authentication route - here tied to password recovery - that fails to enforce the same identity verification as the primary login path. Because SSO plugins sit directly on the authentication boundary and often run with the ability to create sessions for any local account, a logic gap in an alternate channel effectively defeats the entire login control. The single CPE, cpe:2.3:a:miniorange_security_software_pvt_ltd.:oauth_single_sign_on_-_sso_(oauth_client):*, covers all versions from an unspecified start through 38.5.8.

RemediationAI

No vendor-released fixed version is identified in the provided data, so upgrade to any release later than 38.5.8 once miniOrange publishes it and confirm the exact patched version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/miniorange-oauth-oidc-single-sign-on/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-38-5-8-broken-authentication-vulnerability before relying on it. Until a patched build is confirmed, reduce exposure by restricting access to the plugin's authentication and password-recovery endpoints at the web server or WAF layer (Patchstack offers a virtual patch for subscribers), disabling the plugin if SSO is not business-critical, and enforcing strong administrator credentials plus monitoring for unexpected logins or password-reset activity - noting that WAF rules may break legitimate SSO callbacks and disabling the plugin will interrupt federated login. Audit administrator accounts and active sessions for signs of unauthorized access as a precaution.