CVE-2026-12761: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'emailfield' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with sendotptoken() returning the SHA-512(customerkey || otp) transaction hash to the client where the OTP space is only 99,000 values (wprand(1000, 99999)) and the customerkey is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to moopenidsocialloginvalidateotp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPressto a version that resolves this vulnerability.Fixed in 7.7.0 - Configuration
Modify the Profile Completion flow so 'email_field' is not accepted as arbitrary input; instead, verify that the submitted email matches the OAuth provider identity (the email must be the one returned by the OAuth provider).
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress (Profile Completion flow) email_field POST parameter handling = Verify that the email provided in 'email_field' belongs to the identity returned by the OAuth provider (reject arbitrary addresses) - Configuration
Change send_otp_token() so it does not expose the SHA-512(customer_key || otp) transaction hash to the client. OTP should not be limited to ~99,000 values (wp_rand(1000, 99999)), and the client should not be able to crack offline from a leaked hash.
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress send_otp_token() OTP token construction = Do not return SHA-512(customer_key || otp) transaction hash to the client; use a server-side OTP verification/token mechanism with sufficient OTP entropy - Compensating control
As a mitigation until the plugin is fixed, prevent unauthenticated access to the affected Profile Completion OTP endpoints/flows (e.g., restrict the vulnerable OAuth/Profile Completion endpoints so they cannot be triggered to send OTPs by unauthenticated attackers).
- Operational
After applying the fix, review for potential account takeover: invalidate any affected sessions, force password resets for impacted accounts, and rotate any credentials that may have been exposed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12761?
CVE-2026-12761 has a critical severity rating of 9.8.
How do I fix CVE-2026-12761?
To fix CVE-2026-12761, update the miniOrange Social Login and Register plugin for WordPress to version 7.7.1 or later.
What does CVE-2026-12761 affect?
CVE-2026-12761 affects the miniOrange Social Login and Register plugin for WordPress, versions up to and including 7.7.0.
What type of vulnerability is CVE-2026-12761?
CVE-2026-12761 is an authentication bypass vulnerability that can lead to account takeover.
What impact does CVE-2026-12761 have?
The impact of CVE-2026-12761 includes unauthorized access to administrator accounts via the Profile Completion OTP flow.