CVE-2023-2982criticalobserved exploitationCWE-288

CVE-2023-2982: critical vulnerability in cyberlord92 miniOrange Social Login and…

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass

Published · Updated

Follow this CVE+ Monitor miniOrange Social Login and Register

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

99Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 46%
from disclosure to weaponsame day
Published on NVDJun 29
1st PoCJun 29
VulnCheck+172d
The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
cyberlord92 · miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — cyberlord92 miniOrange Social Login and…

In the same product, most dangerous first.

CVE-2026-12761CRITICALminiOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.7.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via Profile Completion OTP FlowEPSS 0.9%CVE-2024-11087HIGHminiOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication BypassEPSS 0.5%