14
CVEs
8
Critical
4
High
0
KEV
1
PoC
11
Unpatched C/H
7.1%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
8
HIGH
4
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Wordpress Plugin
29
Miniorange 2fa
7
PHP
7
Active Directory Integration Ldap Integration
6
Google Authenticator
6
Oauth Single Sign On
4
Wp Oauth Server
3
Saml Sp Single Sign On
3
Headless Single Sign On
3
Wordpress Social Login And Register Discord Google Twitter Linkedin
3
Wordpress Social Login And Register
3
Prevent Files Folders Access
2
Miniorange Otp Verification
2
Saml
2
Otp Verification With Firebase
2
Malware Scanner
2
Oauth Single Sign On Sso Oauth Client
2
Page Restriction
2
Discord Integration
1
Wordpress Rest Api Authentication
1
LDAP
1
Wordpress Security
1
Login Using Wordpress Users
1
Social Login
1
Ldap Integration With Active Directory And Openldap
1
Oauth Openid Connect Single Sign On
1
Saml Sso Service Provider
1
Staff Employee Business Directory For Active Directory
1
Miniorange Discord Integration
1
Login With Otp Over Sms Email Whatsapp And Google Authenticator
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-77771 | Two-factor authentication bypass in the miniOrange 2FA WordPress plugin allows an attacker who has already obtained a victim's password to defeat the second factor through unlimited OTP brute-forcing. The plugin keys its attempt-rate limit to a client-controlled identifier rather than the target account, enabling an adversary to rotate that identifier and circumvent lockout entirely; a separate validation endpoint applies no rate limit at all. A publicly available exploit (WPScan) confirms practical exploitability against plugin versions below 6.3.1 and 19.3. | HIGH | 7.5 | 0.1% | 58 |
PoC
|
| CVE-2026-106610 | Privilege escalation in the miniOrange OTP Verification WordPress plugin through 5.5.7 allows an attacker to gain elevated privileges on affected sites; the supplied CVSS 3.1 vector scores it 9.8 Critical (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), describing a remote, unauthenticated, low-complexity flaw, though the incorrect privilege assignment (CWE-266) may in practice require a low-privileged authenticated account and authentication requirements are not confirmed from available data. No public exploit code or active exploitation (CISA KEV) is identified in the provided intelligence. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-28008 | Authentication bypass in the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin (versions 7.0.0 and earlier) lets an unauthenticated remote attacker defeat the OAuth login flow and authenticate as an arbitrary user, including administrators. The CVSS 3.1 base score is 9.8 with a network, no-privilege, no-interaction vector, and the issue is rooted in improper verification of the identity asserted during single sign-on (CWE-290). At the time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, but the combination of unauthenticated access and full account takeover makes it a high-priority patching target. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-28149 | Unauthenticated PHP object injection in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) lets remote attackers pass attacker-controlled serialized data into a PHP unserialize() call, enabling property-oriented programming (POP) gadget chains that can lead to remote code execution, data theft, or site takeover. The flaw carries a CVSS 9.8 rating with a fully remote, no-authentication, no-interaction vector and was reported by Patchstack; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because SSO plugins sit on the authentication path, a successful exploit can compromise the entire WordPress site. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-61967 | Privilege escalation in the miniOrange OTP Verification WordPress plugin (versions 5.5.1 and earlier) allows unauthenticated remote attackers to elevate their privileges, per a Patchstack advisory. The flaw is rooted in a weak account/OTP verification mechanism (CWE-640) that can be abused without any credentials, and carries a CVSS 9.8 rating reflecting full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the unauthenticated network vector makes this a high-priority patching candidate. | CRITICAL | 9.8 | 0.3% | 49 |
No patch
|
| CVE-2026-28148 | Authentication bypass in the miniOrange Headless Single Sign On WordPress plugin (versions 1.6 and earlier) allows unauthenticated remote attackers to forge or manipulate JWTs and assume the identity of any user, including administrators. The CWE-347 root cause (improper verification of a cryptographic signature) combined with a network attack vector yields a critical 9.8 CVSS. No public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.8 | 0.2% | 49 |
No patch
|
| CVE-2026-62108 | Unauthenticated attackers can bypass the authentication logic of the miniOrange Headless Single Sign On WordPress plugin at versions up to and including 1.7.0, gaining access as arbitrary users - potentially administrators - with full confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Per the assessed vector (AV:N/AC:L/PR:N/UI:N), exploitation requires no credentials, no user interaction, and no client-side prerequisites against an affected installation; the practical limiting factor is deployment, since this is a niche headless-SSO component with a modest install footprint, and the precise configuration state that triggers the bypass is not described in the advisory. At time of analysis there is no CISA KEV entry and no public exploit identified, so the risk is driven by the severity of the flaw and the ease of the network attack path rather than by observed exploitation. Reported by Patchstack (EUVD-2026-81491). | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|
| CVE-2026-97274 | The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable. | CRITICAL | 9.8 | 0.5% | 49 |
No patch
|
| CVE-2026-65520 | SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-61979 | Unauthenticated privilege escalation in the miniOrange SAML SP Single Sign On WordPress plugin (versions ≤ 5.4.3) allows network-accessible attackers to elevate their privileges without any prior authentication. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates exploitation is remotely achievable but requires specific conditions to be met - likely particular SAML configuration states or timing-sensitive request manipulation. Full confidentiality, integrity, and availability impact is reported, consistent with an attacker reaching WordPress administrator-level access. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.1 | 0.3% | 41 |
No patch
|
| CVE-2026-73351 | Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure. | HIGH | 7.1 | 0.2% | 36 |
No patch
|
| CVE-2026-82229 | Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis. | HIGH | 7.1 | 0.1% | 36 |
No patch
|
| CVE-2026-107433 | Missing authorization in the miniOrange WP OAuth Server WordPress plugin (all versions through 6.4.0) allows remote unauthenticated attackers to invoke plugin functionality that should have been gated behind capability or permission checks, resulting in low integrity and availability impact (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Per the assessed vector, no authentication, privileges, or user interaction are required, so any WordPress site with this plugin active and reachable is potentially exposed; confidentiality impact is rated as none. There is no public exploit identified at time of analysis and no CISA KEV listing, and the available data does not identify a vendor-released patched version. | MEDIUM | 6.5 | 0.3% | 32 |
No patch
|
| CVE-2026-97267 | Broken access control in the miniOrange "Prevent files / folders access" WordPress plugin (versions through 2.6.7) lets an authenticated Subscriber - the lowest standard WordPress role - read the contents of files and folders the plugin is configured to protect. The condition is a missing-authorization flaw (CWE-862) scored CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), so the impact is confidentiality-only: protected content can be disclosed, but nothing can be modified or taken offline. No KEV listing, public exploit code, or EPSS signal accompanies this disclosure, so no public exploit identified at time of analysis; practical risk depends on whether self-registration is enabled on the target site or the attacker otherwise holds a Subscriber account. | MEDIUM | 4.3 | 0.3% | 22 |
No patch
|