miniOrange Social Login and Register Plugin Authentication Bypass to Admin Account Takeover

Technical Analysis

The vulnerability chains two design flaws: (1) the Profile Completion flow trusts an attacker-supplied 'email_field' POST parameter instead of the email returned by the OAuth provider, letting an attacker target any victim email including an admin account; (2) send_otp_token() leaks a SHA-512(customer_key || otp) hash to the client while the OTP itself is drawn from a space of only 99,000 possible values (wp_rand(1000, 99999)), and customer_key is a static, often-empty option, making the OTP trivially brute-forceable offline in under a second. The cracked OTP is then submitted to mo_openid_social_login_validate_otp(), which authenticates the attacker as the targeted user, granting full administrator access to the WordPress instance. This is a pre-authentication, unauthenticated remote exploit chain (CVSS 9.8) requiring only HTTP access to the target site. For organizations that run AI agents, RAG pipelines, or automation tooling on compromised WordPress hosts (e.g., using WP as a CMS backend, content source for RAG ingestion, or a management/admin interface tied into agent workflows), admin takeover could expose stored API keys, database credentials, or webhook secrets used by agents, and allow injection of malicious content into agent-consumed data feeds.

Affected Systems

miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin, versions up to and including 7.7.0; any WordPress installation with this plugin active and OAuth/social login enabled.

Indicators of Compromise

• No specific hashes, IPs, or domains published; exploitation indicators would include:
• Anomalous POST requests to admin-ajax.php or plugin REST endpoints with 'email_field' parameter set to admin/target email addresses
• Repeated rapid OTP submission attempts to mo_openid_social_login_validate_otp() endpoint
• Unexpected admin logins following OAuth/social-login flow without corresponding legitimate OAuth provider redirect

Remediation Steps

1. 1

   Update the plugin

   Upgrade miniOrange Social Login and Register to the patched version released by the vendor beyond 7.7.0 as soon as available.

2. 2

   Disable social login temporarily

   If no patch is available, disable the Profile Completion / social login OAuth flow to eliminate the attack surface until a fix is applied.

3. 3

   Audit admin accounts

   Review WordPress admin user list and login logs for unauthorized account creation or suspicious login events tied to OAuth flows.

4. 4

   Enforce WAF rules

   Deploy web application firewall rules to detect and block anomalous POST requests targeting 'email_field' and OTP validation endpoints.

5. 5

   Rotate credentials

   If compromise is suspected, rotate all admin credentials, API keys, and any secrets stored in WordPress that could be exposed to attackers, especially those used by connected automation or agent systems.

6. 6

   Enable MFA

   Require multi-factor authentication for all administrator accounts to reduce impact of credential or session compromise.