cyberlord92 miniOrange Social Login and Register Plugin up to 7.7.0 on WordPress Profile Completion Flow email_field random values

Summaryinfo

A vulnerability described as problematic has been identified in cyberlord92 miniOrange Social Login and Register Plugin up to 7.7.0. Affected by this issue is the function send_otp_token/mo_openid_social_login_validate_otp of the component Profile Completion Flow. Executing a manipulation of the argument email_field can lead to random values. This vulnerability is registered as CVE-2026-12761. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in cyberlord92 miniOrange Social Login and Register Plugin up to 7.7.0. It has been declared as problematic. This vulnerability affects the function send_otp_token/mo_openid_social_login_validate_otp of the component Profile Completion Flow. The manipulation of the argument email_field with an unknown input leads to a random values vulnerability. The CWE definition for the vulnerability is CWE-330. The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. As an impact it is known to affect confidentiality. CVE summarizes:

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the identity returned by the OAuth provider, combined with send_otp_token() returning the SHA-512(customer_key || otp) transaction hash to the client where the OTP space is only 99,000 values (wp_rand(1000, 99999)) and the customer_key is a static option (empty on unregistered installs). This makes it possible for unauthenticated attackers to trigger an OTP email to an arbitrary admin's address, crack the OTP offline from the leaked hash in under a second, and submit the cracked OTP to mo_openid_social_login_validate_otp(), which logs the attacker in as the user whose email was supplied — granting full administrator access.

The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2026-12761 since 06/19/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1600.001.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• cyberlord92

Name

• miniOrange Social Login and Register Plugin

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion