identity-authentication-vulnerabilityinternet-facing-service-vulnerabilitywidely-deployed-product-advisoryprivilege-escalation-method

Authentication Bypass in miniOrange WordPress SSO Plugin Enables Site Takeover

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 10, 2026

A critical broken authentication flaw tracked as CVE-2026-57807 affects the miniOrange OAuth Single Sign On - SSO (OAuth Client) WordPress plugin and allows unauthenticated remote attackers to compromise vulnerable sites. The issue impacts plugin versions through 38.5.8 and is classified as CWE-288. According to public reporting and the CVE entry, the bug abuses the plugin's password recovery flow to let an attacker authenticate as arbitrary WordPress users, including administrators, creating a direct path to full website takeover.

The vulnerability carries a CVSS 9.8 rating and is considered low complexity and remotely exploitable with no user interaction required. Patchstack disclosed the issue and warned it is likely to face mass exploitation, while noting that no official vendor patch was available at the time of reporting. Defenders were urged to immediately remove the affected plugin or limit exposure to WordPress login and password recovery endpoints until miniOrange releases a fix; Patchstack also said it had issued a virtual patch for protected customers.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Jul 9, 2026 – Jul 10, 2026

Jul 10, 20264mo ago
CVE-2026-57807 is newly received by Patchstack
The CVE feed entry states that CVE-2026-57807 was newly received by Patchstack on July 10, 2026. The vulnerability was recorded as a broken authentication issue enabling password recovery exploitation in the miniOrange OAuth Single Sign On - SSO (OAuth Client) WordPress plugin through version 38.5.8.
CVE-2026-57807 - WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerability
Jul 9, 20264mo ago
Patchstack discloses CVE-2026-57807 and issues a virtual patch
Patchstack disclosed a critical broken authentication vulnerability, CVE-2026-57807, in the miniOrange WordPress OAuth Single Sign-On (SSO (OAuth Client)) plugin on July 9, 2026. The flaw affects versions through 38.5.8, no official vendor fix was available at the time, and Patchstack released a virtual patch while warning the issue was likely to be mass exploited.
Critical Wordpress Plugin Vulnerability Allow Attackers to Gain Full Control Over Website

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Password-recovery authentication bypass in miniOrange OAuth Single Sign On (CVE-2026-57807)

Affected products

1 linked

Wordpress

Organizations

2 linked

MiniorangeminiOrange Security Software Pvt Ltd.

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cyber Security NewsNews · Jul 13, 2026

Critical Wordpress Plugin Vulnerability Allow Attackers to Gain Full Control Over WebsiteOpen source ↗

Cvefeed High SeverityAdvisories · Jul 10, 2026

CVE-2026-57807 - WordPress OAuth Single Sign On - SSO (OAuth Client) plugin <= 38.5.8 - Broken Authentication vulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News