CVE-2026-57807 & CVE-2026-12761: Two vulnerable WordPress plugins by miniOrange, 9.8 rating both 🔥

There are two authentication bypass vulnerabilities disclosed in miniOrange plugins: OAuth Single Sign On - SSO & Social Login and Register (Discord, Google, Twitter, LinkedIn). These flaws might allow a malicious actor to gain admin access to the website.

Search at Netlas.io:
👉 Link: https://nt.ls/M4c8B
👉 Dork: http.body:"plugins/miniorange-oauth-oidc-single-sign-on" OR http.body:"miniorange-login-openid"

Read more:
https://patchstack.com/database/wordpress/plugin/miniorange-oauth-oidc-single-sign-on/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-38-5-8-broken-authentication-vulnerability?_s_id=cve
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/miniorange-login-openid/miniorange-social-login-and-register-discord-google-twitter-linkedin-770-unauthenticated-authentication-bypass-to-administrator-account-takeover-via-profile-completion-otp-flow