miniOrange Social Login email verification permits unauthenticated account takeover
miniOrange Social Login and Register before 7.8.0 is vulnerable to authentication bypass when social login is configured and its optional Profile Completion email-verification feature is enabled. An unauthenticated attacker can request a valid one-time code for an email address they control, then replay that code against a victim's email address because the plugin does not bind the code to the account for which it was issued. The plugin then creates a valid session for the victim account, allowing takeover of any account, including an Administrator. WPScan has withheld the proof of concept until August 8, 2026. Version 7.8.0 fixes the issue.
- Component
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
- Affected
- < 7.8.0
- Safe version
7.8.0- Published
- Jul 29, 2026
This CVE was published Jul 29, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update miniOrange Social Login and Register to 7.8.0 or later. Confirm that no unexpected administrator sessions or account changes occurred; if immediate updating is not possible, disable the optional Profile Completion email-verification flow or deactivate the plugin until it can be updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H