miniOrange Vulnerabilities and Affected Products
Vulnerabilities associated with OAuth Single Sign On – SSO (OAuth Client).
Products
Clear product- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)5 vulnerabilities
- miniorange otp verification4 vulnerabilities
- WordPress Social Login and Register3 vulnerabilities
- Custom API for WP2 vulnerabilities
- Headless Single Sign On2 vulnerabilities
- Malware Scanner2 vulnerabilities
- miniOrange Discord Integration2 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)2 vulnerabilities
- otp_verification2 vulnerabilities
- SAML SP Single Sign On2 vulnerabilities
- web_application_firewall2 vulnerabilities
- wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\)2 vulnerabilities
- Backup and Restore1 vulnerability
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login1 vulnerability
- Malware Scanner plugin and Web Application Firewall plugin for WordPress1 vulnerability
- malware_scanner1 vulnerability
- miniOrange WordPress SAML SSO Premium1 vulnerability
- miniOrange WordPress SAML SSO Premium MulsiteSite1 vulnerability
- miniOrange WordPress SAML SSO Standard1 vulnerability
- miniOrange's Google Authenticator1 vulnerability
- miniOrange's Google Authenticator (WordPress plugin)1 vulnerability
- miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login1 vulnerability
- OAuth 2.0 client for SSO (WordPress plugin)1 vulnerability
- OAuth Single Sign On Enterprise1 vulnerability
- OAuth Single Sign On Free1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-28008CRITICAL | WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerabilityUnauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. CWE-290Aug 13, 2026 | CVSS9.8v3.1 | EPSS- | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-34155HIGH | WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken AuthenticationImproper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3. CWE-287Jul 18, 2023 | CVSS8.8v3.1 | EPSS0.958% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |