# CVE-2026-120844: miniOrange OAuth Single Sign On privilege escalation

Source: https://junglewise.ai/threats/cve-2026-120844-incorrect-privilege-assignment-vulnerability-in-miniorange-oauth  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-120844 · Severity: critical · CVSS 9.8 · Published 2026-11-06

A vulnerability in the miniOrange OAuth Single Sign On plugin for WordPress allows unauthenticated attackers to escalate their privileges and gain administrative control of affected websites. An attacker exploiting this flaw can take full control of a WordPress site, access sensitive data, and perform malicious actions on behalf of the site owner. This is a critical issue affecting all WordPress sites using the vulnerable plugin version.

Technologies: [miniOrange OAuth Single Sign On - SSO (OAuth Client)](https://junglewise.ai/threats/technologies/oauth-single-sign-on-sso-oauth-client). Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-120844 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120844 being exploited in the wild.

**How severe is CVE-2026-120844?** Critical severity, with a CVSS score of 9.8, published 6 November 2026.

**Which products and versions are affected?** miniOrange OAuth Single Sign On - SSO (OAuth Client) through 7.1.3.

**Is there a fix for CVE-2026-120844?** Yes: fixed in 7.1.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120844 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120844?** Check whether you run miniOrange OAuth Single Sign On - SSO (OAuth Client) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.1.4

## Technical details

The OAuth Single Sign On plugin improperly assigns privileges, permitting unauthenticated users to escalate to administrator role. The vulnerability in versions 7.1.3 and earlier requires no authentication and can be triggered remotely over the network. Successful exploitation grants full administrative access to the affected WordPress installation.

## Affected products

- miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3

## Timeline

- 2026-11-06: disclosed
- 2026-11-04: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-1-3-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-1-3-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [miniOrange OAuth Single Sign On SSO authentication bypass](https://junglewise.ai/threats/cve-2026-97274-unauthenticated-bypass-vulnerability-in-oauth-single-sign-on-sso)
- [miniOrange OAuth Single Sign On authentication bypass in OAuth Client](https://junglewise.ai/threats/cve-2026-57807-miniorange-oauth-single-sign-on-authentication-bypass-in-oauth)