Executive brief
A vulnerability in a popular WordPress social login plugin allows unauthorized individuals to take over any user account, including administrator accounts. The plugin fails to properly verify that a security code belongs to the specific user requesting it, allowing an attacker to use their own code to log in as someone else. This could result in a total site takeover, data theft, or unauthorized administrative changes.
Technical details
The miniOrange Social Login and Register plugin (versions before 7.8.0) fails to bind one-time codes used in its 'Profile Completion' email-verification feature to the specific account for which they were generated. An unauthenticated attacker can exploit this by requesting a verification code for an email address they control and then replaying that valid code against a victim's email address (such as an administrator). This results in an authentication bypass and a valid session for the target account. For a site to be vulnerable, the 'Profile Completion' feature must be enabled and social login must be configured. The issue is fixed in version 7.8.0.
Affected products
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0
Timeline
- 2026-07-08: disclosed: Publicly published by WPScan
- 2026-07-29: advisory: NVD publication date