miniOrange Vulnerabilities and Affected Products

Products

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)5 vulnerabilities
miniorange otp verification4 vulnerabilities
WordPress Social Login and Register3 vulnerabilities
Custom API for WP2 vulnerabilities
Headless Single Sign On2 vulnerabilities
Malware Scanner2 vulnerabilities
miniOrange Discord Integration2 vulnerabilities
OAuth Single Sign On – SSO (OAuth Client)2 vulnerabilities
otp_verification2 vulnerabilities
SAML SP Single Sign On2 vulnerabilities
web_application_firewall2 vulnerabilities
wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\)2 vulnerabilities
Backup and Restore1 vulnerability
LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login1 vulnerability
Malware Scanner plugin and Web Application Firewall plugin for WordPress1 vulnerability
malware_scanner1 vulnerability
miniOrange WordPress SAML SSO Premium1 vulnerability
miniOrange WordPress SAML SSO Premium MulsiteSite1 vulnerability
miniOrange WordPress SAML SSO Standard1 vulnerability
miniOrange's Google Authenticator1 vulnerability
miniOrange's Google Authenticator (WordPress plugin)1 vulnerability
miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login1 vulnerability
OAuth 2.0 client for SSO (WordPress plugin)1 vulnerability
OAuth Single Sign On Enterprise1 vulnerability
OAuth Single Sign On Free1 vulnerability

miniOrange vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-61979HIGH	WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions. CWE-266Aug 13, 2026	CVSS8.1v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-61967CRITICAL	WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions. CWE-640Aug 13, 2026	CVSS9.8v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-28149CRITICAL	WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. CWE-502Aug 13, 2026	CVSS9.8v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-28148CRITICAL	WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. CWE-347Aug 13, 2026	CVSS9.8v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-28008CRITICAL	WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. CWE-290Aug 13, 2026	CVSS9.8v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-65520CRITICAL	WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions. CWE-89Aug 6, 2026	CVSS9.3v3.1	EPSS0.291%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-61957HIGH	WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. CWE-79Jul 27, 2026	CVSS7.1v3.1	EPSS0.146%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-65561MEDIUM	WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions. CWE-79Jul 27, 2026	CVSS6.5v3.1	EPSS0.13%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59545HIGH	WordPress miniOrange Discord Integration plugin <= 2.2.4 - Broken Authentication vulnerability Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions. CWE-288Jul 23, 2026	CVSS8.1v3.1	EPSS0.268%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-42731CRITICAL	WordPress miniorange otp verification plugin <= 5.4.9 - Privilege Escalation vulnerability Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9. CWE-266May 27, 2026	CVSS9.8v3.1	EPSS0.333%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2021-47979HIGH	WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory. CWE-22May 16, 2026	CVSS8.7v4.0	EPSS0.397%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-68974MEDIUM	WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0. CWE-98Dec 30, 2025	CVSS6.6v3.1	EPSS0.413%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-54745MEDIUM	WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1. CWE-862Dec 18, 2025	CVSS6.5v3.1	EPSS0.29%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-53561MEDIUM	WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal Vulnerability Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0. CWE-35Aug 20, 2025	CVSS6.5v3.1	EPSS0.424%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-54048CRITICAL	WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2. CWE-89Aug 20, 2025	CVSS9.3v3.1	EPSS0.418%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-54049CRITICAL	WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2. CWE-266Aug 20, 2025	CVSS9.9v3.1	EPSS0.407%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-31019HIGH	WordPress Password Policy Manager plugin <= 2.0.4 - Account Takeover vulnerability Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4. CWE-288Jun 9, 2025	CVSS8.8v3.1	EPSS0.516%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-47670HIGH	WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10. CWE-98May 23, 2025	CVSS8.1v3.1	EPSS0.592%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-47672HIGH	WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integration miniorange-discord-integration allows PHP Local File Inclusion.This issue affects miniOrange Discord Integration: from n/a through <= 2.2.2. CWE-98May 23, 2025	CVSS8.1v3.1	EPSS0.592%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-39545MEDIUM	WordPress REST API Authentication plugin <= 3.6.3 - Settings Change Vulnerability Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.6.3. CWE-862Apr 16, 2025	CVSS5.4v3.1	EPSS0.487%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-41873MEDIUM	WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4. CWE-862Dec 13, 2024	CVSS4.3v3.1	EPSS0.408%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-37987MEDIUM	WordPress YourMembership Single Sign On plugin <= 1.1.3 - Broken Access Control vulnerability Missing Authorization vulnerability in miniOrange YourMembership Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YourMembership Single Sign On: from n/a through 1.1.3. CWE-862Dec 13, 2024	CVSS6.5v3.1	EPSS0.584%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-24375LOW	WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 - Broken Access Control vulnerability Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.5.14. CWE-862Dec 9, 2024	CVSS3.5v3.1	EPSS0.431%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-25455MEDIUM	WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.6.0 - Arbitrary Content Deletion vulnerability Missing Authorization vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.0. CWE-862Dec 9, 2024	CVSS5.3v3.1	EPSS0.73%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2023-47776MEDIUM	WordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerability Missing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1. CWE-862Dec 9, 2024	CVSS4.3v3.1	EPSS0.328%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX