Critical Authentication Bypass in WordPress OAuth Single Sign-On (SSO) Plugin by miniOrange (CVE-2026-57807)
Critical Authentication Bypass in WordPress OAuth Single (TL-2026-1262), also tracked as miniOrange OAuth SSO Password Recovery Bypass, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-13. It has no confirmed attribution, affects miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO, references 1 CVE (CVE-2026-57807), maps to 16 MITRE ATT&CK techniques (T1046, T1078, T1078.004), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1262
- Threat ID
- TL-2026-1262
- Also known as
- miniOrange OAuth SSO Password Recovery Bypass
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, ecommerce, education, government administration, health, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Critical Authentication Bypass in WordPress OAuth Single
Malware and tooling: Patchstack virtual patch / WAF rule for CVE-2026-57807
The WordPress OAuth Single Sign-On (SSO) OAuth Client plugin by miniOrange (versions through 38.5.8) contains a CWE-288 authentication bypass in its password-recovery path that lets an unauthenticated remote attacker authenticate as any user, including administrators. CVSS 9.8, no official vendor patch as of disclosure; Patchstack expects mass-exploit campaigns consistent with the pattern seen against other unauthenticated WordPress plugin admin-takeover flaws in 2026.
How Critical Authentication Bypass in WordPress OAuth Single works
CVE-2026-57807 is a critical unauthenticated authentication-bypass vulnerability (CWE-288, Authentication Bypass Using an Alternate Path or Channel) in the OAuth Single Sign On - SSO (OAuth Client) plugin for WordPress, developed by miniOrange Security Software Pvt Ltd. (plugin slug miniorange-oauth-oidc-single-sign-on). The plugin implements OAuth/OIDC-based SSO for WordPress sites and additionally ships its own password-recovery flow as a fallback account-recovery mechanism. That fallback path fails to enforce the authentication controls that gate the plugin's primary OAuth login flow: it exposes an 'alternate path or channel' (per NVD's CWE-288 classification) that a remote, unauthenticated attacker can invoke directly to trigger or manipulate the password-recovery/account-provisioning logic for an arbitrary target account, including site administrators, without ever presenting valid IdP-issued credentials or completing the intended OAuth handshake.
Because the flaw sits in the recovery/provisioning logic rather than in the OAuth token-validation path itself, standard OAuth hardening (redirect_uri allow-listing, state/PKCE validation, JWT signature checks) does not mitigate it — the attacker never touches the OAuth code-exchange step at all. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a fully remote, low-complexity, zero-privilege, zero-interaction attack with complete confidentiality/integrity/availability impact, consistent with a full site takeover once an admin-level session is forged.
The vulnerability was reported to Patchstack by independent researcher Kim Dvash on 2026-06-06 and publicly disclosed by Patchstack on 2026-07-09, with NVD publication on 2026-07-10. As of disclosure, miniOrange has not shipped an official patch; Patchstack has issued a virtual-patch/WAF rule to its customers to block exploitation attempts pending a vendor fix. No confirmed active exploitation or public PoC had been observed at time of writing, but Patchstack explicitly flagged this as high-priority and likely to see mass, automated exploitation given the pattern of 2026 WordPress plugin auth-bypass campaigns (e.g., CVE-2026-8181 in Burst Statistics, CVE-2026-0352 in UpdraftPlus), where botnets fingerprint the vulnerable plugin slug/version via passive HTTP probing within hours of disclosure and complete automated admin takeover in seconds once a target is confirmed vulnerable.
miniOrange's WordPress authentication plugin family has a recurring history of authentication-bypass defects: CVE-2023-2982 in the related Social Login and Register plugin (CVSS 9.8, ~30,000+ installs, insufficient encryption of the supplied login identifier) and earlier OAuth-client authentication issues (CVE-2022-2133, CVE-2022-34858), indicating a systemic pattern of insufficiently validated alternate-authentication paths across the vendor's product line rather than an isolated defect.
MITRE ATT&CK techniques used in TL-2026-1262
Discovery
T1046 Network Service Discovery; T1518 Software Discovery
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Privilege Escalation
Defense Evasion
Persistence
T1098 Account Manipulation; T1136.001 Local Account; T1505.003 Web Shell
Command and Control
Credential Access
T1212 Exploitation for Credential Access; T1606 Forge Web Credentials
Collection
T1213 Data from Information Repositories
Impact
T1491 Defacement; T1531 Account Access Removal
Reconnaissance
T1595.002 Vulnerability Scanning
defense-impairment
Affected products and versions in Critical Authentication Bypass in WordPress OAuth Single
- miniOrange Security Software Pvt Ltd. — OAuth Single Sign On - SSO (OAuth Client)
Vulnerable versions: <= 38.5.8
Remediation for Critical Authentication Bypass in WordPress OAuth Single
Patches
- No official miniOrange patch available as of 2026-07-13; monitor plugins.miniorange.com and the WordPress.org plugin changelog for a fixed release above 38.5.8
Immediate actions
- Deactivate the OAuth Single Sign On - SSO (OAuth Client) plugin (slug miniorange-oauth-oidc-single-sign-on) on all WordPress sites running version 38.5.8 or earlier until a vendor patch is available
- Block or restrict direct access to the plugin's password-recovery / account-provisioning endpoints at the reverse proxy or WAF layer
- Deploy Patchstack's published virtual-patch/WAF rule for this vulnerability if using Patchstack
- Force-reset credentials and invalidate active sessions for all administrator accounts on affected sites
- Review wp_users and wp_usermeta for unexpected new administrator accounts or privilege escalations since 2026-06-06 (report date)
- Enable MFA for all administrator accounts as defense-in-depth against forged sessions
Workarounds
- Patchstack virtual patch / WAF rule (available to Patchstack customers) blocking exploitation of the alternate password-recovery path
- Temporary plugin deactivation is the only complete workaround absent a vendor patch
Longer-term hardening
- Migrate to vendor-supported SSO/authentication mechanisms once a patched plugin version is released
- Implement WAF rules that specifically monitor and rate-limit password-recovery and account-provisioning endpoints on all installed WordPress authentication plugins
- Adopt a WordPress plugin inventory/SBOM process with automated CVE monitoring (e.g., WPScan, Patchstack, Wordfence feeds) given miniOrange's recurring auth-bypass history across its plugin family
- Apply least-privilege and network segmentation for WordPress administrative interfaces (wp-admin) independent of plugin-level authentication
CVEs associated with Critical Authentication Bypass in WordPress OAuth Single
Weaknesses (CWE) in Critical Authentication Bypass in WordPress OAuth Single
CWE-288
Timeline of Critical Authentication Bypass in WordPress OAuth Single
- miniOrange patches three edition-specific 'IdP Deletion via CSRF' vulnerabilities (CVSS 5.4) in the Standard (fixed 28.4.9), Premium (fixed 38.4.9), and Enterprise (fixed 48.4.9) tracks of the same OAuth Single Sign On plugin family, establishing an earlier documented weakness in the plugin's authentication/IdP-management logic.
- miniOrange patches an 'Incorrect Authorization to Sensitive Information Exposure' flaw (CVSS 5.3) across five concurrently-maintained version tracks of the plugin (fixed in 30.5.4, 38.5.4, 40.5.4, 48.5.4, 50.5.4), showing the vendor actively maintains multiple parallel release branches — relevant because CVE-2026-57807 affects the 38.x branch up to 38.5.8, a version above this prior fix.
- Independent researcher Kim Dvash reports the authentication-bypass flaw in the miniOrange OAuth Single Sign On - SSO (OAuth Client) plugin to Patchstack.
- Cyber Security News publishes coverage of the vulnerability, prompting the initial hunt/ingestion of this threat record.
- Patchstack publicly discloses CVE-2026-57807 (Patchstack ID a3890a0fcaf2) and rates it high-priority, warning of expected mass-exploit campaigns; no official miniOrange patch exists at disclosure, and the plugin has no Vulnerability Disclosure Program (VDP) with Patchstack.
- TheHackerWire and other outlets publish secondary analysis of the authentication-bypass mechanism and expected exploitation risk.
- NVD publishes the CVE-2026-57807 record (source identifier audit@patchstack.com) with CVSS 3.1 base score 9.8 (Critical), exploitability sub-score 3.9, impact sub-score 5.9, and CWE-288 classification.
- Threadlinqs Intelligence Platform compiles this research record; no vendor patch, no confirmed public PoC, and no CISA KEV listing observed as of this date.
Sources cited for Critical Authentication Bypass in WordPress OAuth Single
- Critical WordPress Plugin Vulnerability Allows Attackers to Gain Full Control Over Website
- Broken Authentication in WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin
- CVE-2026-57807: Authentication Bypass Using an Alternate Path or Channel
- NVD - CVE-2026-57807
- CWE-288: Authentication Bypass Using an Alternate Path or Channel
- Miniorange Oauth Oidc Single Sign On WordPress Plugin Security Vulnerabilities
- Miniorange Social Login and Register <= 7.6.3 - Authentication Bypass (CVE-2023-2982)
- miniOrange Addresses Authentication Bypass Vulnerability in WordPress Social Login and Register WordPress Plugin
- Critical Security Flaw in Social Login Plugin for WordPress Exposes Users' Accounts
- Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin
- Authentication Bypass Flaw in Updraft Plus WordPress Plugin (CVE-2026-0352)
Threats related to Critical Authentication Bypass in WordPress OAuth Single
- CVE-2026-57309: Unauthenticated Blind SQL Injection in Windu CMS 4.1 (with CVE-2026-57310 Weak Password Hashing and CVE-2026-57311 Unrestricted File Upload)
- wp2shell RCE Chain in WordPress Core (CVE-2026-60137, CVE-2026-63030) — Emergency Patch Released
- Active Exploitation of Cisco Unified Communications Manager WebDialer SSRF (CVE-2026-20230) and Catalyst SD-WAN Manager Root Privilege-Escalation Zero-Day (CVE-2026-20245)
- CVE-2026-63030 (wp2shell): Unauthenticated Remote Code Execution in WordPress Core REST API Batch Endpoint via Chained SQL Injection (CVE-2026-60137)
- CISA KEV: Joomla iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291) Unrestricted File Upload Flaws Under Active Exploitation
- CVE-2026-48939 & CVE-2026-56291: Perfect-10 Joomla Extension Bugs (iCagenda, Balbooa Forms) Actively Exploited, Added to CISA KEV
Detection coverage for TL-2026-1262
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1262 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.