miniOrange Discord Integration EUVD-2026-48198

Exploitation requires the miniOrange Discord Integration plugin (version ≤ 2.2.4) to be installed and active on the target WordPress site with its Discord authentication/login flow enabled - that flow is the exposed alternate authentication path. No WordPress credentials and no user interaction are needed (PR:N/UI:N), so any remote actor can reach it. The limiting factor is the AC:H rating: the attacker must satisfy additional non-trivial preconditions to succeed, plausibly including knowledge of a target user's identifier/email or manipulation of a specific state or token in the OAuth exchange, which prevents trivial spray-and-pray exploitation. The precise conditions are not enumerated in the available data and should be confirmed against the Patchstack advisory.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H combines two opposing signals: AV:N/PR:N/UI:N make this reachable by any remote, unauthenticated actor with no user interaction, which is severe, while AC:H indicates the attacker must satisfy specific, non-trivial preconditions (such as knowing or predicting a target's identifier, or winning a timing/state condition), which sharply narrows practical exploitation. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active or automated exploitation at this time; the 8.1 rating is driven by high potential impact rather than demonstrated ease of attack. Net assessment: a genuine account-takeover risk worth prompt patching, but the AC:H barrier and absence of exploit signals place it below drop-everything status relative to low-complexity unauthenticated bypasses. Note the Patchstack tag labels this 'Information Disclosure' while the CVSS records full I:H/A:H impact - a mismatch to verify against the vendor advisory.

A remote attacker targets a WordPress site running the miniOrange Discord Integration plugin and sends crafted requests to the plugin's authentication flow, supplying or manipulating an identity assertion that the plugin trusts without proper verification. By satisfying the specific conditions required (raising attack complexity), the attacker establishes an authenticated session as a targeted WordPress user without ever presenting that user's password. No public POC is currently known, so exploitation would require independent development against the flawed authentication logic.