Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-14300 – Authentication Bypass – miniOrange Social Login and Register WordPress Plugin be…

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-14300 is a high-severity authentication bypass vulnerability (CWE-287) in the miniOrange Social Login and Register WordPress plugin (Discord, Google, Twitter, LinkedIn) affecting all versions before 7.8.0. An unauthenticated attacker can hijack any account on an affected site — including administrator accounts — by obtaining a one-time verification code for an email address they control and replaying it against a victim’s email address, because the plugin fails to bind the code to the account for which it was issued. The CVSS v3.1 base score is 8.1 (HIGH).

Technical details

  • Root cause: The plugin’s optional email-verification flow, part of the Profile Completion feature, issues one-time codes (OTPs) with no server-side binding between the code and the target user account. Any valid code can be submitted against any account’s email address.
  • Trigger conditions: Exploitation requires two non-default site configurations to be active simultaneously: the Profile Completion feature must be enabled, and social login must be configured. Sites running the plugin with these settings active are exposed.
  • Attack steps: An unauthenticated attacker (1) requests an OTP to the email verification endpoint using an email address they control; (2) receives the valid code; (3) replays that same code against a victim’s email address in the same verification flow. The server accepts the unbound code and establishes a fully authenticated session for the victim’s account.
  • Impact: Complete authentication bypass including takeover of administrator-level accounts. WordPress administrator access enables arbitrary code execution through plugin and theme uploads, making the effective impact equivalent to unauthenticated remote code execution. CVSS impact metrics reflect High confidentiality, integrity, and availability.
  • No public proof-of-concept at time of publication. A public PoC is currently scheduled for release on August 8, 2026, per the coordinated disclosure timeline. Organizations should treat this as a narrow patching window.

Affected software

  • miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) — all versions before 7.8.0

Severity

  • CVSS v3.1 Base Score: 8.1 (HIGH)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and recommended actions

  • Immediate: Update the miniOrange Social Login and Register plugin to version 7.8.0 or later. Version 7.8.1 is currently available on the WordPress.org plugin repository and contains the fix.
  • If immediate patching is not feasible: Disable the Profile Completion (email-verification) feature within the plugin’s settings to eliminate the vulnerable code path until the update can be applied. This removes the attack surface without requiring a full update.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge