Executive brief
A vulnerability in a popular WordPress social login plugin allows unauthorized individuals to take over any user account, including administrator accounts. By exploiting a flaw in how the plugin handles email verification and one-time passwords (OTPs), an attacker can gain full control over the website. This could lead to total site compromise, data theft, or the installation of malicious software.
Technical details
The vulnerability exists in the Profile Completion flow of the miniOrange Social Login and Register plugin. It stems from two primary issues: first, the 'email_field' POST parameter accepts arbitrary email addresses without verifying they belong to the OAuth identity; second, the send_otp_token() function leaks a SHA-512 hash of the OTP (combined with a static or empty customer_key) to the client. Because the OTP space is small (1,000 to 99,999), an attacker can perform an offline brute-force attack on the hash in under a second. By submitting the cracked OTP to the validation function, the attacker is authenticated as the user associated with the provided email address, typically targeting an administrator.
Affected products
- miniOrange miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) up to and including 7.7.0
Timeline
- 2026-07-10: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/class-mo-openid-login-widget.php
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/mo-openid-social-login-functions.php
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/view/profile_completion/mo_openid_prof_comp_funct.php
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/view/profile_completion/mo_openid_prof_comp_funct.php
- https://plugins.trac.wordpress.org/changeset/3592642/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a56b59ce-29c2-4172-b703-a06d7bb28da0?source=cve