Miniorange Social Login And Register Discord Google Twitter Linkedin
Monthly
Account takeover in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 lets unauthenticated attackers hijack any account, including administrators. The optional email-verification one-time code is not bound to the account it was issued for, so an attacker requests a code for an email they control and replays it against a victim's email to obtain a valid session. Publicly available exploit code exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Authentication bypass in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin through version 7.7.0 lets unauthenticated attackers seize any account, including administrators. The Profile Completion flow trusts an attacker-supplied 'email_field' POST value without confirming it matches the OAuth provider's verified identity, and the send_otp_token() routine leaks a SHA-512(customer_key||otp) hash to the client where the OTP is one of only 99,000 values and customer_key is a static (often empty) option - so the OTP can be brute-forced offline in under a second. Rated CVSS 9.8; no public exploit identified at time of analysis, but the full attack primitive is described in the Wordfence advisory.
Account takeover in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 lets unauthenticated attackers hijack any account, including administrators. The optional email-verification one-time code is not bound to the account it was issued for, so an attacker requests a code for an email they control and replays it against a victim's email to obtain a valid session. Publicly available exploit code exists (WPScan) and a vendor patch is available, though EPSS remains low at 0.14%.
Authentication bypass in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin through version 7.7.0 lets unauthenticated attackers seize any account, including administrators. The Profile Completion flow trusts an attacker-supplied 'email_field' POST value without confirming it matches the OAuth provider's verified identity, and the send_otp_token() routine leaks a SHA-512(customer_key||otp) hash to the client where the OTP is one of only 99,000 values and customer_key is a static (often empty) option - so the OTP can be brute-forced offline in under a second. Rated CVSS 9.8; no public exploit identified at time of analysis, but the full attack primitive is described in the Wordfence advisory.