Is CVE-2026-120844 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-120844 being exploited in the wild.

How severe is CVE-2026-120844?

Critical severity, with a CVSS score of 9.8, published 6 November 2026.

Which products and versions are affected?

miniOrange OAuth Single Sign On - SSO (OAuth Client) through 7.1.3.

Is there a fix for CVE-2026-120844?

Yes: fixed in 7.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-120844 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-120844?

Check whether you run miniOrange OAuth Single Sign On - SSO (OAuth Client) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-120844: miniOrange OAuth Single Sign On privilege escalation

CVE-2026-120844 · Severity: critical · CVSS 9.8 · Published 2026-11-06

A vulnerability in the miniOrange OAuth Single Sign On plugin for WordPress allows unauthenticated attackers to escalate their privileges and gain administrative control of affected websites. An attacker exploiting this flaw can take full control of a WordPress site, access sensitive data, and perform malicious actions on behalf of the site owner. This is a critical issue affecting all WordPress sites using the vulnerable plugin version.

Technologies: miniOrange OAuth Single Sign On - SSO (OAuth Client). Vendors: miniOrange.

Quick answers

Is CVE-2026-120844 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-120844 being exploited in the wild.
How severe is CVE-2026-120844?: Critical severity, with a CVSS score of 9.8, published 6 November 2026.
Which products and versions are affected?: miniOrange OAuth Single Sign On - SSO (OAuth Client) through 7.1.3.
Is there a fix for CVE-2026-120844?: Yes: fixed in 7.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120844 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-120844?: Check whether you run miniOrange OAuth Single Sign On - SSO (OAuth Client) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7.1.4

Technical details

The OAuth Single Sign On plugin improperly assigns privileges, permitting unauthenticated users to escalate to administrator role. The vulnerability in versions 7.1.3 and earlier requires no authentication and can be triggered remotely over the network. Successful exploitation grants full administrative access to the affected WordPress installation.

Affected products

miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3

Timeline

2026-11-06: disclosed
2026-11-04: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.