miniOrange Vulnerabilities and Affected Products
Vulnerabilities associated with Custom API for WP.
Products
Clear product- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)5 vulnerabilities
- miniorange otp verification4 vulnerabilities
- WordPress Social Login and Register3 vulnerabilities
- Custom API for WP2 vulnerabilities
- Headless Single Sign On2 vulnerabilities
- Malware Scanner2 vulnerabilities
- miniOrange Discord Integration2 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)2 vulnerabilities
- otp_verification2 vulnerabilities
- SAML SP Single Sign On2 vulnerabilities
- web_application_firewall2 vulnerabilities
- wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\)2 vulnerabilities
- Backup and Restore1 vulnerability
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login1 vulnerability
- Malware Scanner plugin and Web Application Firewall plugin for WordPress1 vulnerability
- malware_scanner1 vulnerability
- miniOrange WordPress SAML SSO Premium1 vulnerability
- miniOrange WordPress SAML SSO Premium MulsiteSite1 vulnerability
- miniOrange WordPress SAML SSO Standard1 vulnerability
- miniOrange's Google Authenticator1 vulnerability
- miniOrange's Google Authenticator (WordPress plugin)1 vulnerability
- miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login1 vulnerability
- OAuth 2.0 client for SSO (WordPress plugin)1 vulnerability
- OAuth Single Sign On Enterprise1 vulnerability
- OAuth Single Sign On Free1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2025-54048CRITICAL | WordPress Custom API for WP <= 4.2.2 - SQL Injection VulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2. CWE-89Aug 20, 2025 | CVSS9.3v3.1 | EPSS0.418% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-54049CRITICAL | WordPress Custom API for WP <= 4.2.2 - Privilege Escalation VulnerabilityIncorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2. CWE-266Aug 20, 2025 | CVSS9.9v3.1 | EPSS0.407% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |