# CVE-2026-12761: miniOrange Social Login and Register authentication bypass in Profile Completion flow

Source: https://junglewise.ai/threats/cve-2026-12761-miniorange-social-login-and-register-authentication-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-12761 · Severity: critical · CVSS 9.8 · Published 2026-07-10

A vulnerability in a popular WordPress social login plugin allows unauthorized individuals to take over any user account, including administrator accounts. By exploiting a flaw in how the plugin handles email verification and one-time passwords (OTPs), an attacker can gain full control over the website. This could lead to total site compromise, data theft, or the installation of malicious software.

Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-12761 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12761 being exploited in the wild.

**How severe is CVE-2026-12761?** Critical severity, with a CVSS score of 9.8, published 10 July 2026.

**Which products and versions are affected?** miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) up to and including 7.7.0.

**Is there a fix for CVE-2026-12761?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12761 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12761?** Check whether you run miniOrange Social Login and Register (Discord, Google, Twitter or LinkedIn) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Profile Completion flow of the miniOrange Social Login and Register plugin. It stems from two primary issues: first, the 'email_field' POST parameter accepts arbitrary email addresses without verifying they belong to the OAuth identity; second, the send_otp_token() function leaks a SHA-512 hash of the OTP (combined with a static or empty customer_key) to the client. Because the OTP space is small (1,000 to 99,999), an attacker can perform an offline brute-force attack on the hash in under a second. By submitting the cracked OTP to the validation function, the attacker is authenticated as the user associated with the provided email address, typically targeting an administrator.

## Affected products

- miniOrange miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) up to and including 7.7.0

## Timeline

- 2026-07-10: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/class-mo-openid-login-widget.php](https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/class-mo-openid-login-widget.php)
- [https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/mo-openid-social-login-functions.php](https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/mo-openid-social-login-functions.php)
- [https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/view/profile_completion/mo_openid_prof_comp_funct.php](https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/view/profile_completion/mo_openid_prof_comp_funct.php)
- [https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/view/profile_completion/mo_openid_prof_comp_funct.php](https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/view/profile_completion/mo_openid_prof_comp_funct.php)
- [https://plugins.trac.wordpress.org/changeset/3592642/](https://plugins.trac.wordpress.org/changeset/3592642/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/a56b59ce-29c2-4172-b703-a06d7bb28da0?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/a56b59ce-29c2-4172-b703-a06d7bb28da0?source=cve)

## Related threats

- [miniOrange Social Login and Register account takeover in Profile Completion](https://junglewise.ai/threats/cve-2026-14300-miniorange-social-login-and-register-account-takeover-in-profile)