Executive brief
The miniOrange Discord Integration plugin for WordPress, which allows users to link their Discord accounts to their website, contains a security flaw that allows unauthorized individuals to bypass authentication. An attacker could exploit this to gain administrative access to the website, potentially leading to full site takeover and data theft. This vulnerability is considered high priority as it can be targeted in automated mass-exploit campaigns.
Technical details
A broken authentication vulnerability (CWE-288) exists in the miniOrange Discord Integration plugin for WordPress in versions up to and including 2.2.4. The flaw resides in the handling of the Discord OAuth callback mechanism, allowing an unauthenticated attacker to bypass security checks and perform actions with the privileges of other users, including administrators. While the attack complexity is rated as high, successful exploitation allows for complete compromise of confidentiality, integrity, and availability. The issue is addressed in version 2.2.5, which includes fixes to properly validate authentication requests.
Affected products
- miniOrange miniOrange Discord Integration <= 2.2.4
Timeline
- 2026-07-16: other: Vulnerability reported by researcher buitu
- 2026-07-22: advisory: Patchstack advisory published
- 2026-07-23: disclosed: CVE published to NVD dataset
- 2026-07-23: patched: Version 2.2.5 released to address the vulnerability