Miniorange Social Login And Register (Discord, Google, Twitter, Linkedin)
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:miniorange_social_login_and_register_(discord,_google,_twitter,_linkedin):*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Miniorange Social Login And Register (Discord, Google, Twitter, Linkedin) (3bca7c5c-248b-51cc-a845-214892907a07) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-14300 |
vulnerable | 2026-09-16 04:33:12.015101 |
miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
Published: 2026-07-29T06:00:03.431Z
Updated: 2026-07-30T15:20:09.656Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.