CVE-2026-14300: unknown miniorange social login and register (discord, google, twitter, linkedin) Improper Authentication

Vulnerability summary

CVE-2026-14300 is a critical (CVSS 9.8) Improper Authentication vulnerability in unknown miniorange social login and register (discord, google, twitter, linkedin). EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 31.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 29-07-2026
   PublishedVulnerability first disclosed.
2. 30-07-2026
   Last modifiedVulnerability information updated.

Description

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.