CVE-2026-12761: miniOrange WordPress Social Login Auth Bypass Enables Full Admin Takeover

Executive Summary

A critical authentication bypass vulnerability in the miniOrange Social Login and Register WordPress plugin allows unauthenticated remote attackers to achieve full administrator account takeover on any affected WordPress site. Tracked as CVE-2026-12761 with a CVSS score of 9.8, the flaw chains three separate logic failures — including a weak OTP that can be cracked offline in under one second — to bypass all authentication controls without any user interaction.

CVSS Score: 9.8 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The miniOrange Social Login and Register plugin is installed on over 900,000 WordPress sites, enabling social login via Google, Discord, Twitter, LinkedIn, and other OAuth providers.

Vulnerability Overview

Three-Flaw Attack Chain

CVE-2026-12761 is not a single bug — it is a chain of three compounding logic errors:

Flaw 1: Email Ownership Bypass

During the plugin's profile completion flow, the email_field POST parameter accepts arbitrary email addresses without verifying ownership through the OAuth provider. An attacker can submit any email address — including that of a known site administrator — without completing a legitimate OAuth handshake.

Flaw 2: Trivially Weak OTP Design

The plugin's send_otp_token() function issues a one-time passcode and transmits SHA-512(customer_key || otp) to clients as a "verification hint." The design fails in two critical ways:

• OTP space is only 99,000 values (6-digit numerical range starting from 1)
• customer_key is empty by default on fresh or unregistered installations — making the hash SHA-512("" || otp), which reduces the search space to a single SHA-512 preimage computation per guess

An attacker can precompute all 99,000 possible hashes and find the correct OTP in under one second on standard hardware.

Flaw 3: Authentication Validation Logic Error

The mo_openid_social_login_validate_otp() function authenticates a user based solely on the supplied email address after OTP verification, without re-validating that the email was confirmed against the original OAuth identity. Submitting the cracked OTP alongside a target administrator email grants full authenticated access.

Attack Flow

1. Attacker triggers an OTP email to a known WordPress admin email address
2. Attacker receives the SHA-512(customer_key || otp) hash from the server response
3. Attacker brute-forces all 99,000 OTP values offline — completes in under 1 second
4. Attacker submits the cracked OTP with the target admin's email
5. Plugin authenticates the attacker as the administrator with no further checks

No privileges required. No user interaction required. Fully remote.

Affected Versions

Check your version via Plugins → Installed Plugins → Social Login in the WordPress admin dashboard, or via WP-CLI:

wp plugin get miniorange-login-openid --fields=version

Patch and Mitigation

Immediate Action

Update the plugin immediately via the WordPress plugin repository:

# Update via WP-CLI
wp plugin update miniorange-login-openid

Or navigate to Dashboard → Updates in WordPress admin and update the Social Login plugin.

If Immediate Update Is Not Possible

• Deactivate the plugin until the update can be applied — this removes the attack surface entirely
• Restrict wp-login.php and admin access by IP allowlist using your web server or a firewall plugin
• Audit recent user registrations and administrator role assignments for suspicious entries

Detection: Signs of Active Exploitation

Review your WordPress logs and database for:

• Unexpected new administrator accounts (especially with free email provider addresses)
• POST requests to the plugin's OTP verification endpoint from unusual IP addresses
• Bulk OTP submission attempts (brute-force signature) in web server access logs
• Modified administrator passwords or plugin settings

Historical Context

This is not the first critical authentication bypass in the miniOrange Social Login plugin. CVE-2023-2982 (also CVSS 9.8) affected the same plugin and was widely exploited across thousands of WordPress sites in 2023. The recurrence of a near-identical vulnerability class suggests systemic issues in the plugin's authentication architecture.

WordPress site operators running any version of this plugin should treat updates as urgent.

Timeline

Recommendations

1. Update immediately to the latest miniOrange Social Login version
2. Audit administrator accounts — remove any unrecognized admin users
3. Reset compromised credentials if exploitation is suspected
4. Implement 2FA on all WordPress administrator accounts as a defense-in-depth measure
5. Monitor for unusual login patterns using a WordPress security plugin (Wordfence, Sucuri, etc.)

References

• NVD — CVE-2026-12761
• WordPress Plugin: miniOrange Social Login and Register
• CWE-287: Improper Authentication
• Prior: CVE-2023-2982 — miniOrange Social Login CVSS 9.8