miniOrange OAuth SSO (WordPress): Authentication bypass

Summary

The WordPress plugin OAuth Single Sign On – SSO (OAuth Client) up to and including version 7.1.2 contains a bypass vulnerability (CWE-290, spoofing via authentication bypass) that can be exploited without authentication. According to Patchstack, an attacker can get around the security checks of the plugin remotely over the network, without credentials or user interaction, which can lead to a total impact on confidentiality, integrity and availability. Patchstack rates the issue as high priority and reports that it is expected to be exploited, although no public proof of concept or exploitation has been confirmed. The NVD status is currently Deferred.

Affected

• WordPress plugin OAuth Single Sign On – SSO (OAuth Client) (slug miniorange-login-with-eve-online-google-facebook), versions <= 7.1.2
• Edition/tier coverage not confirmed; check each installed edition (Free, Standard, Premium, Enterprise)

Fixed in

• Version 7.1.3 or later (per Patchstack and WPScan; verify against the WordPress.org changelog)

Workaround

• No vendor workaround known.
• Deactivating the plugin until the update is installed is a recommended interim step (not a documented vendor mitigation).
• Patchstack offers a virtual patch rule for its customers.

Exploitation

• CISA SSVC: exploitation none, automatable yes, technical impact total.
• Not listed in CISA KEV; EPSS below 1%.
• No public proof of concept found; mechanism not publicly described.

Our recommendation

• Inventory WordPress sites for this plugin and note the installed version and edition.
• Update to version 7.1.3 or later immediately; if not possible, deactivate the plugin.
• Review administrator accounts and recently created users, and check logs for unauthorised access.
• Monitor the Patchstack and miniOrange advisories, and note that a separate record, CVE-2026-57807, reports an unpatched critical authentication bypass in the same plugin and needs separate verification.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory CVE-2026-97274 patchstack.com
• OpenCVE CVE-2026-97274 app.opencve.io
• WPScan plugin miniorange-login-with-eve-online-google-facebook wpscan.com
• Vulners Patchstack entry vulners.com
• Ionix threat center CVE-2026-57807 www.ionix.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:52.