Is CVE-2026-12761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12761 being exploited in the wild.

How severe is CVE-2026-12761?

Critical severity, with a CVSS score of 9.8, published 10 July 2026.

Which products and versions are affected?

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) up to and including 7.7.0.

Is there a fix for CVE-2026-12761?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12761 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12761?

Check whether you run miniOrange Social Login and Register (Discord, Google, Twitter or LinkedIn) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12761: miniOrange Social Login and Register authentication bypass in Profile Completion flow

CVE-2026-12761 · Severity: critical · CVSS 9.8 · Published 2026-07-10

A vulnerability in a popular WordPress social login plugin allows unauthorized individuals to take over any user account, including administrator accounts. By exploiting a flaw in how the plugin handles email verification and one-time passwords (OTPs), an attacker can gain full control over the website. This could lead to total site compromise, data theft, or the installation of malicious software.

Vendors: miniOrange.

Quick answers

Is CVE-2026-12761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12761 being exploited in the wild.
How severe is CVE-2026-12761?: Critical severity, with a CVSS score of 9.8, published 10 July 2026.
Which products and versions are affected?: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) up to and including 7.7.0.
Is there a fix for CVE-2026-12761?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12761 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12761?: Check whether you run miniOrange Social Login and Register (Discord, Google, Twitter or LinkedIn) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Profile Completion flow of the miniOrange Social Login and Register plugin. It stems from two primary issues: first, the 'email_field' POST parameter accepts arbitrary email addresses without verifying they belong to the OAuth identity; second, the send_otp_token() function leaks a SHA-512 hash of the OTP (combined with a static or empty customer_key) to the client. Because the OTP space is small (1,000 to 99,999), an attacker can perform an offline brute-force attack on the hash in under a second. By submitting the cracked OTP to the validation function, the attacker is authenticated as the user associated with the provided email address, typically targeting an administrator.

Affected products

miniOrange miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) up to and including 7.7.0

Timeline

2026-07-10: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.