CVE-2026-12761: miniOrange WordPress Auth Bypass Vulnerability

CVE-2026-12761 Overview

CVE-2026-12761 is an authentication bypass vulnerability in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress, affecting all versions up to and including 7.7.0. The Profile Completion flow accepts an arbitrary email address via the email_field POST parameter without confirming the email belongs to the identity returned by the OAuth provider. Combined with a weak OTP scheme, unauthenticated attackers can log in as any user, including administrators. The flaw is classified under [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated attackers can take over any WordPress account, including administrators, resulting in full site compromise.

Affected Products

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress
All versions up to and including 7.7.0
WordPress sites with the plugin installed and OAuth Profile Completion enabled

Discovery Timeline

2026-07-10 - CVE-2026-12761 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-12761

Vulnerability Analysis

The vulnerability chains two weaknesses in the plugin's Profile Completion and OTP verification flow. First, the email_field POST parameter accepted during Profile Completion is trusted as-is and never validated against the identity returned by the OAuth provider. An attacker can therefore submit an administrator's email address and trigger a verification email to that address. Second, the send_otp_token() function returns a transaction hash to the client computed as SHA-512(customer_key || otp), where the OTP is generated by wp_rand(1000, 99999) and the customer_key is a static WordPress option that is empty on installations that were never registered with miniOrange.

Root Cause

The OTP keyspace contains only 99,000 possible values, and the hash construction leaks the OTP to any client that can call the endpoint. Because customer_key is static and often empty, an attacker can brute force the SHA-512 hash offline in well under one second. The Profile Completion handler then calls mo_openid_social_login_validate_otp(), which logs the caller in as the account identified by the attacker-supplied email_field once the correct OTP is submitted.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker initiates the social login flow, supplies the target administrator's email through email_field, and captures the transaction hash returned by send_otp_token(). The attacker iterates the 99,000-value OTP space against the leaked hash, submits the recovered OTP to the validation endpoint, and receives an authenticated session as the targeted administrator. See the Wordfence Vulnerability Analysis and the WordPress Plugin Code Review for the affected code paths.

Detection Methods for CVE-2026-12761

Indicators of Compromise

Unexpected OTP verification emails delivered to administrator mailboxes without corresponding user-initiated login attempts.
New administrator sessions originating from IP addresses or user agents inconsistent with legitimate admin activity.
Repeated POST requests to the plugin's Profile Completion and mo_openid_social_login_validate_otp endpoints from a single source.
Modifications to WordPress users, plugins, themes, or options shortly after an OTP email was issued.

Detection Strategies

Inspect web server access logs for POST requests containing the email_field parameter targeting the miniOrange plugin endpoints.
Alert on high-frequency invocations of send_otp_token() or the OTP validation action within short time windows.
Correlate outbound OTP email events with the source IP that initiated the request and flag mismatches with the account owner.

Monitoring Recommendations

Monitor WordPress audit logs for administrator role assignments, plugin installations, and file uploads following OAuth login events.
Track authentication anomalies such as first-time-seen admin logins, geo-velocity violations, and off-hours privileged access.
Forward WordPress and web server telemetry to a centralized analytics platform to enable correlation across the authentication chain.

How to Mitigate CVE-2026-12761

Immediate Actions Required

Update the miniOrange Social Login and Register plugin to the version released in WordPress Changeset 3592642, which addresses versions after 7.7.0.
Rotate passwords and invalidate active sessions for all administrator accounts on affected WordPress sites.
Review WordPress user lists for unauthorized administrators and audit recent plugin, theme, and file changes.
Confirm the customer_key option is populated after upgrade if continuing to use the plugin's OTP features.

Patch Information

The vendor addressed the vulnerability in the miniOrange Social Login and Register plugin release referenced by WordPress Changeset 3592642. Site administrators should apply the update through the WordPress plugin manager or by installing the fixed release directly from the plugin repository.

Workarounds

Deactivate and remove the miniOrange Social Login and Register plugin until the patched release can be installed.
Restrict access to wp-admin and the plugin's OTP endpoints by IP allowlist or web application firewall rule.
Enforce multi-factor authentication on all WordPress administrator accounts using an independent, unaffected MFA plugin.

bash

# Emergency mitigation: disable the vulnerable plugin via WP-CLI
wp plugin deactivate miniorange-login-openid
wp plugin delete miniorange-login-openid

# After patching, verify the installed version
wp plugin get miniorange-login-openid --field=version