WordPress security by component

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)

Plugin description

miniOrange Social Login and Register adds social login and registration using Discord, Google, Twitter, and LinkedIn accounts.

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) (miniorange-social-login-and-register-discord-google-twitter-linkedin) is a WordPress plugin with 1 published CVE record in this archive. The latest tracked vulnerability was published Jul 29, 2026; the highest published CVSS base score is 8.1.

Plugin slug: miniorange-social-login-and-register-discord-google-twitter-linkedin

Latest vulnerability

CVE-2026-14300: miniOrange Social Login email verification permits unauthenticated account takeover

miniOrange Social Login and Register before 7.8.0 is vulnerable to authentication bypass when social login is configured and its optional Profile Completion email-verification feature is enabled. An unauthenticated attacker can request a valid one-time code for an email address they control, then replay that code against a victim's email address because the plugin does not bind the code to the account for which it was issued. The plugin then creates a valid session for the victim account, allowing takeover of any account, including an Administrator. WPScan has withheld the proof of concept until August 8, 2026. Version 7.8.0 fixes the issue.

PublishedJul 29, 2026

Known safe version7.8.0

Published vulnerabilities for miniorange-social-login-and-register-discord-google-twitter-linkedin
		Safe version
Jul 29, 2026	CVE-2026-14300 miniOrange Social Login email verification permits unauthenticated account takeover miniOrange Social Login and Register before 7.8.0 is vulnerable to authentication bypass when social login is configured and its optional Profile Completion email-verification feature is enabled. An unauthenticated attacker can request a valid one-time code for an email address they control, then replay that code against a victim's email address because the plugin does not bind the code to the account for which it was issued. The plugin then creates a valid session for the victim account, allowing takeover of any account, including an Administrator. WPScan has withheld the proof of concept until August 8, 2026. Version 7.8.0 fixes the issue.	7.8.0	CVE8.1

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers