What is the CVSS score of CVE-2026-59545?

CVE-2026-59545 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of miniOrange Discord Integration are affected by CVE-2026-59545?

The miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) contains an authentication bypass vulnerability allowing remote attackers to impersonate legitimate WordPress…

How to fix or mitigate CVE-2026-59545?

Within 24 hours, audit all WordPress installations for miniOrange Discord Integration plugin versions 2.2.4 and earlier and disable the plugin immediately if found. Change passwords for all WordPress user accounts, particularly administrative users, and enable multi-factor authentication if not already in place. Within 7 days, review WordPress audit logs and access records for signs of unauthorized activity or account access since the plugin's installation or most recent update. Monitor Discord integration logs for suspicious authentication attempts. At 30 days, continue monitoring vendor advisories for a security patch release for the miniOrange Discord Integration plugin; once released, apply the patch and re-enable the plugin after thorough testing in a staging environment.

miniOrange Discord Integration CVE-2026-59545

EUVD-2026-48198 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-07-23 Patchstack

GHSA-g3gm-pf8v-8953

WordPress Information Disclosure Wordpress Plugin Miniorange Discord Integration Miniorange

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated remote account takeover justifies PR:N and high CIA impact, while the specific preconditions required to bypass authentication warrant AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:44 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 8.1

DescriptionCVE.org

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

AnalysisAI

Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is the miniOrange Discord Integration WordPress plugin (CPE cpe:2.3:a:miniorange:miniorange_discord_integration), which bridges WordPress accounts with Discord for social login and role synchronization. CWE-288 (Authentication Bypass Using an Alternate Path or Channel / improper authentication) means the plugin exposes a code path that establishes an authenticated session or trusts an identity assertion without properly validating the credential or token - for OAuth/social-login bridges this typically stems from unvalidated or forgeable identity parameters (e.g., trusting a Discord identifier or email supplied in a request rather than a cryptographically verified token). Because the check happens before any WordPress login credential is required, the alternate path effectively substitutes for the normal authentication gate.

RemediationAI

Upgrade the miniOrange Discord Integration plugin to the first release above 2.2.4 published by the vendor; the exact fixed version is not independently confirmed from the provided data, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/miniorange-discord-integration/vulnerability/wordpress-miniorange-discord-integration-plugin-2-2-4-broken-authentication-vulnerability) and the vendor's changelog for the patched build before deploying - no vendor-released patch version is identified at time of analysis. If a fixed version is not yet available or cannot be applied immediately, the most reliable compensating control is to deactivate the plugin entirely, which removes the vulnerable authentication path at the cost of disabling Discord login and role-sync functionality. Where deactivation is not acceptable, restrict access to the plugin's authentication/callback endpoints via a WAF rule or web-server access control and monitor for anomalous logins, accepting that endpoint filtering may break legitimate Discord OAuth callbacks and requires knowing the exact endpoint paths.