CVE-2026-14300 in Social Login and Register Plugin
Summary
by MITRE • 07/29/2026
The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in the miniOrange Social Login and Register WordPress plugin affects versions prior to 7.8.0 and represents a critical session management flaw that undermines the security of user authentication processes. This issue stems from improper binding of one-time verification codes to specific user accounts, creating a fundamental weakness in the plugin's email verification mechanism. The vulnerability allows unauthenticated attackers to exploit the profile completion feature by requesting verification codes for email addresses they control and then replaying those codes against victim accounts, effectively bypassing authentication requirements.
The technical flaw manifests in the plugin's failure to establish proper cryptographic binding between verification codes and target user accounts during the profile completion process. When users request email verification through social login configurations, the system generates one-time codes without adequately associating them with specific account identifiers or session contexts. This design oversight creates a replay attack vector where attackers can intercept valid verification codes and apply them to different accounts within the same WordPress installation. The vulnerability specifically impacts installations where both the Profile Completion feature is enabled and social login functionality is configured, making it exploitable in environments that utilize multiple social authentication providers including Discord, Google, Twitter, and LinkedIn.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential complete system compromise when administrators are targeted. Attackers who successfully exploit this flaw can obtain valid sessions for any account in the WordPress installation, including those with elevated privileges such as administrator roles. This creates a pathway for unauthorized access to sensitive administrative functions, data manipulation, and potential lateral movement within the compromised environment. The vulnerability is particularly concerning because it leverages legitimate plugin features that are commonly enabled by users seeking enhanced user experience through social authentication while maintaining security through email verification.
Security implications of this vulnerability align with CWE-345 Insufficient Verification of Data Authenticity, which addresses weaknesses in verifying data integrity and authenticity during authentication processes. The flaw also correlates with ATT&CK technique T1078 Valid Accounts, as it enables attackers to obtain legitimate session tokens for existing accounts without requiring knowledge of passwords or other credentials. Organizations should implement immediate mitigations including upgrading to version 7.8.0 or later where this vulnerability has been addressed, disabling the Profile Completion feature if not essential, and monitoring for suspicious authentication patterns. Additionally, security teams should conduct comprehensive audits of WordPress installations to identify other potentially vulnerable plugins and ensure proper session management practices are enforced throughout all authentication pathways.