CVE-2026-14300
Received Received - Intake

Unauthenticated Session Hijack in miniOrange Social Login WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: WPScan

Description
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-29
Last Modified
2026-07-29
Generated
2026-07-29
AI Q&A
2026-07-29
EPSS Evaluated
N/A
NVD
CVE-2026-14300
EUVD
EUVD-2026-50121

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miniorange social_login_and_register to 7.8.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in the miniOrange Social Login and Register WordPress plugin before version 7.8.0 allows unauthenticated attackers to take over any user account, including administrators. It occurs because the plugin does not properly link the one-time verification code used in its email-verification feature to the specific account it was issued for. Attackers can request a code for an email they control and replay it against a victim's email to gain access.

Detection Guidance

Check if the miniOrange Social Login and Register WordPress plugin version is below 7.8.0. Inspect the plugin's files for the Profile Completion feature configuration. Look for improper binding of one-time verification codes in the email-verification process.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to any account on your WordPress site, including admin accounts. If exploited, attackers could take control of your site, steal data, or perform malicious actions. It requires the Profile Completion feature to be enabled and social login configured.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA compliance requirements. It may result in data breaches, unauthorized disclosures, and failure to protect personal health or user information, leading to legal penalties and reputational damage.

Mitigation Strategies

Update the miniOrange Social Login and Register plugin to version 7.8.0 or higher immediately. Disable the Profile Completion feature if not required. Review user accounts for unauthorized access and revoke any suspicious sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14300. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart