Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-12761— miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow

CVSS 9.8 · Critical EPSS 0.46% · P38

Affected Version Matrix 1

VendorProductVersion RangeStatus
cyberlord92miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)≤ 7.7.0affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-12761

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP Flow
Source: CVE Program / CVE List V5
Vulnerability Description
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress miniOrange Social Login and Register 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress miniOrange Social Login and Register是WordPress基金会的一款集成社交登录与注册功能的CMS插件。 WordPress miniOrange Social Login and Register 7.7.0及之前版本存在授权问题漏洞，该漏洞源于Profile Completion流程通过'email_field' POST参数接受任意邮件地址而未验证其属于OAuth提供商返回的身份，且send_otp_token()向客户端返回SHA-512(c
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
cyberlord92miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) 0 ~ 7.7.0 -

II. Public POCs for CVE-2026-12761

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-12761

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-12761 (1)

Vendor Pages for CVE-2026-12761 (1)

Other References for CVE-2026-12761 (1)

IV. Related Vulnerabilities

Same product: miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
Same vendor: cyberlord92
Same weakness: CWE-287

V. Comments for CVE-2026-12761

No comments yet

Leave a comment