CVE-2026-14300: miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress pluginto a version that resolves this vulnerability.Fixed in 7.8.0 - Configuration
Disable the plugin's Profile Completion feature, since exploitation requires it to be enabled.
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin Profile Completion feature = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14300?
The severity of CVE-2026-14300 is rated high with a CVSS score of 8.1.
How do I fix CVE-2026-14300?
To fix CVE-2026-14300, you should update the miniOrange Social Login and Register plugin to version 7.8.0 or later.
What does CVE-2026-14300 exploit?
CVE-2026-14300 exploits the lack of binding for the one-time code in the email-verification feature, allowing unauthenticated account takeover.
Who is affected by CVE-2026-14300?
Users of the miniOrange Social Login and Register plugin version before 7.8.0 on WordPress are affected by CVE-2026-14300.
What actions should I take if I am using an affected version related to CVE-2026-14300?
If you are using an affected version of the miniOrange plugin, immediately update to version 7.8.0 or later to mitigate the risk.