CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
Unauthenticated attackers can take over any account, including administrators, by replaying one-time codes if Profile Completion is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-14300?
CVE-2026-14300 is a high-severity authentication bypass vulnerability in Unknown miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn), published on 29 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
Weakness: CWE-287
Which versions are affected by CVE-2026-14300?
How do I fix CVE-2026-14300?
No fix has been published for CVE-2026-14300 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-14300 being exploited?
There is no known exploitation of CVE-2026-14300 in the wild and no public exploit code.
Sources
Also known as GHSA-6xgh-57mv-pxm7.