Summary
CVE-2026-28008 is a critical unauthenticated authentication bypass vulnerability (CWE-290: Authentication Bypass by Spoofing) affecting the miniOrange OAuth Single Sign On – SSO (OAuth Client) WordPress plugin. The flaw allows a remote, unauthenticated attacker to spoof identity and bypass the plugin’s authentication logic, potentially gaining access to accounts on the affected site. It carries a CVSS v3.1 base score of 9.8 (Critical).
Technical details
- Root cause: The plugin’s OAuth Client authentication flow is susceptible to identity spoofing, allowing authentication controls to be bypassed without valid credentials (CWE-290, mapped to CAPEC-151 Identity Spoofing).
- Trigger conditions: No authentication or user interaction is required; the vulnerable code path is reachable by any remote, unauthenticated party.
- Attack vector: Network (AV:N) — exploitable directly over HTTP/HTTPS against the plugin’s OAuth login/callback handling.
- Impact: Full compromise of confidentiality, integrity, and availability, consistent with unauthorized authentication as another user/account on the affected WordPress site.
Affected software
- miniOrange OAuth Single Sign On – SSO (OAuth Client) WordPress plugin, versions up to and including 7.0.0.
Severity
- CVSS v3.1 Base Score: 9.8 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin to version 7.0.1 or later, where the authentication bypass has been fixed.
- If immediate patching is not possible: Restrict or disable public access to the plugin’s OAuth login/callback endpoints until the update can be applied, and monitor authentication logs for unexpected or anomalous logins.
How IONIX identifies potentially affected assets
IONIX matches the following signal against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Raw HTTP response body:
/wp-content/plugins/miniorange-login-with-eve-online-google-facebook/

