# CVE-2026-14300: miniOrange Social Login and Register account takeover in Profile Completion

Source: https://junglewise.ai/threats/cve-2026-14300-miniorange-social-login-and-register-account-takeover-in-profile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-14300 · Severity: info · CVSS 8.1 · Published 2026-07-29

A vulnerability in a popular WordPress social login plugin allows unauthorized individuals to take over any user account, including administrator accounts. The plugin fails to properly verify that a security code belongs to the specific user requesting it, allowing an attacker to use their own code to log in as someone else. This could result in a total site takeover, data theft, or unauthorized administrative changes.

Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-14300 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14300 being exploited in the wild.

**How severe is CVE-2026-14300?** Informational severity, with a CVSS score of 8.1, published 29 July 2026.

**Which products and versions are affected?** miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0.

**Is there a fix for CVE-2026-14300?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14300 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14300?** Check whether you run miniOrange Social Login and Register (Discord, Google, Twitter or LinkedIn) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The miniOrange Social Login and Register plugin (versions before 7.8.0) fails to bind one-time codes used in its 'Profile Completion' email-verification feature to the specific account for which they were generated. An unauthenticated attacker can exploit this by requesting a verification code for an email address they control and then replaying that valid code against a victim's email address (such as an administrator). This results in an authentication bypass and a valid session for the target account. For a site to be vulnerable, the 'Profile Completion' feature must be enabled and social login must be configured. The issue is fixed in version 7.8.0.

## Affected products

- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.8.0

## Timeline

- 2026-07-08: disclosed: Publicly published by WPScan
- 2026-07-29: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/7ecf657b-b059-4420-8c36-f38d58960d2b/](https://wpscan.com/vulnerability/7ecf657b-b059-4420-8c36-f38d58960d2b/)

## Related threats

- [miniOrange Social Login and Register authentication bypass in Profile Completion flow](https://junglewise.ai/threats/cve-2026-12761-miniorange-social-login-and-register-authentication-bypass-in)