EUVD-2026-43026
GHSA-6rhq-rx45-fhhp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated (AV:N/PR:N/UI:N); offline OTP crack in under a second keeps AC:L; admin takeover yields full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied - granting full administrator access.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin through version 7.7.0 lets unauthenticated attackers seize any account, including administrators. The Profile Completion flow trusts an attacker-supplied 'email_field' POST value without confirming it matches the OAuth provider's verified identity, and the send_otp_token() routine leaks a SHA-512(customer_key||otp) hash to the client where the OTP is one of only 99,000 values and customer_key is a static (often empty) option - so the OTP can be brute-forced offline in under a second. Rated CVSS 9.8; no public exploit identified at time of analysis, but the full attack primitive is described in the Wordfence advisory.
Technical ContextAI
The affected component is a WordPress social-login plugin (cpe:2.3:a:cyberlord92:miniorange_social_login_and_register...) that federates identity from OAuth providers such as Google, Discord, Twitter and LinkedIn. The root cause is CWE-287 (Improper Authentication): after an OAuth round-trip the Profile Completion handler (mo_openid_prof_comp_funct.php) accepts an arbitrary 'email_field' rather than binding the session to the email asserted by the provider, breaking the trust chain between the OAuth assertion and the local account. Compounding this, send_otp_token() (mo-openid-social-login-functions.php) returns the server-side verification hash SHA-512(customer_key || otp) to the browser. Because the OTP is generated with wp_rand(1000, 99999) - an effective keyspace of roughly 99,000 candidates - and customer_key is a static plugin option that is empty on installs never registered with miniOrange, the leaked hash is trivially reversible offline, defeating the OTP as a second factor and letting mo_openid_social_login_validate_otp() authenticate the attacker as the supplied email's owner.
RemediationAI
Upstream fix available (changeset 3592642); a released patched version above 7.7.0 is referenced by the vendor's SVN commit but the exact tagged release is not independently confirmed in the provided data - update the plugin to the latest available version from the WordPress.org repository and verify it is newer than 7.7.0, consulting the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/a56b59ce-29c2-4172-b703-a06d7bb28da0) and the changeset (https://plugins.trac.wordpress.org/changeset/3592642/) for the fixed version number. If immediate patching is not possible, the highest-value compensating control is to deactivate the miniOrange Social Login plugin entirely, which stops the vulnerable Profile Completion and OTP endpoints but disables social login for users; alternatively, block or restrict access to the plugin's AJAX/login action endpoints (the mo_openid social-login and OTP-validation actions) at a WAF or reverse proxy, accepting that overly broad rules may break legitimate OAuth callbacks. Deploying a virtual patch via a WordPress firewall (e.g. Wordfence) that filters requests supplying attacker-controlled 'email_field' values reduces exposure without removing functionality. After patching, audit administrator and user accounts for unexpected additions or logins and rotate credentials, since exploitation leaves the attacker with a legitimate authenticated session.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today