CVE-2026-14300: miniOrange Social Login Auth Bypass Flaw

CVE-2026-14300 Overview

CVE-2026-14300 is an authentication bypass vulnerability [CWE-287] in the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before version 7.8.0. The plugin's optional email-verification (Profile Completion) feature fails to bind its one-time code to the account it was issued for. Unauthenticated attackers can request a verification code for an email address they control, then replay it against a victim's email address to gain a valid session. The flaw allows takeover of any account, including administrators, when the Profile Completion feature is enabled and social login is configured.

Critical Impact
Unauthenticated attackers can hijack administrator accounts on affected WordPress sites by replaying an attacker-obtained one-time code against arbitrary target email addresses.

Affected Products

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin, versions before 7.8.0
WordPress sites with the Profile Completion feature enabled
WordPress sites with social login providers configured

Discovery Timeline

2026-07-29 - CVE-2026-14300 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14300

Vulnerability Analysis

The vulnerability resides in the plugin's email-verification workflow used by the Profile Completion feature. When a user completes social login, the plugin issues a one-time code to confirm the user's email address. The code is not cryptographically bound to the specific email address or account for which it was generated. An attacker who requests a code for their own email can then submit that code alongside a victim's email address, and the plugin accepts it as valid. The plugin then establishes an authenticated session for the victim account.

This authentication bypass grants full session privileges of the targeted account. When the target is a WordPress administrator, the attacker obtains complete control of the site, including the ability to install plugins, modify content, and pivot to further compromise.

Root Cause

The root cause is missing verification-code-to-identity binding in the Profile Completion feature. Secure one-time code implementations must associate each token with the exact account or email address it was issued for, and reject any attempt to redeem a token against a different identity. The plugin validates only the code value, not the code-to-email mapping.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker initiates a social login flow using an email address they control, receives a valid Profile Completion code, then replays the code against the victim's email address. Exploitation preconditions are that the Profile Completion feature is enabled and at least one social login provider is configured. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-14300

Indicators of Compromise

Unexpected administrator logins originating from IP addresses without prior authentication history for the account.
Multiple Profile Completion code requests from a single source targeting different email addresses in a short interval.
New administrator or elevated-role accounts, plugin installations, or theme modifications following a social login event.
WordPress session cookies issued for privileged accounts without a corresponding password authentication or OAuth callback log.

Detection Strategies

Audit WordPress wp_users and wp_usermeta tables for recently modified administrator accounts and correlate with plugin authentication logs.
Inspect web server access logs for repeated POST requests to the miniOrange Social Login verification endpoints followed by successful authenticated sessions.
Compare the email used to request a verification code against the email finally authenticated in each session flow, and alert on mismatches.

Monitoring Recommendations

Enable WordPress audit logging for authentication events, role changes, and plugin activity.
Monitor for the plugin version in use across all WordPress instances and alert on versions below 7.8.0.
Forward WordPress and web server logs to a centralized analytics platform for correlation across sessions, source IPs, and email identifiers.

How to Mitigate CVE-2026-14300

Immediate Actions Required

Update the miniOrange Social Login and Register plugin to version 7.8.0 or later on all WordPress sites.
Disable the Profile Completion feature until the plugin is patched if immediate updates are not feasible.
Review administrator and privileged accounts for unauthorized additions or modifications and rotate credentials.
Invalidate all active WordPress sessions to terminate any attacker-established sessions.

Patch Information

Upgrade the miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin to version 7.8.0 or later. This release binds the Profile Completion one-time code to the requesting email address, preventing cross-account replay. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Profile Completion feature in the plugin settings to remove the vulnerable code path.
Deactivate social login providers temporarily if the plugin cannot be updated and Profile Completion cannot be disabled.
Restrict administrator account creation and enforce multi-factor authentication on privileged WordPress accounts through a separate plugin or reverse-proxy control.

bash

# Update the plugin via WP-CLI to the fixed version
wp plugin update miniorange-login-openid --version=7.8.0

# Verify installed version
wp plugin get miniorange-login-openid --field=version

# List administrator accounts to review for unauthorized additions
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered