CVE-2026-14300

Name of the Vulnerable Software and Affected Versions miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin versions prior to 7.8.0

Description The optional email-verification (Profile Completion) feature fails to bind the one-time code to the specific account for which it was issued. This allows unauthenticated attackers to obtain a valid session for any account, including those with administrator privileges, by requesting a code for an email address they control and replaying it against the victim's email address. This issue is exploitable only if the Profile Completion feature is enabled and social login is configured.

Recommendations Update the plugin to version 7.8.0 or later. As a temporary mitigation, disable the Profile Completion feature.