Vulnerability Intelligence Report
miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
CVE-2026-14300
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
No Active Exploit Signals
CVSS Base Score
8.1
HIGH
Exploitability:2.3
Impact Score:5.9
EPSS Probability:0.14%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-287 ↗CWE-287 Improper Authentication
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| Unknown | miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) | 0 < 7.8.0 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.139%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | WPScan · Vendor · France |
| Reserved | 2026-07-01T10:48:09 |
| Published | 2026-07-29T06:00:03 |
| Last Updated | 2026-07-30T15:20:09 |
Community Chatter & Buzz