Loading story…
A critical broken authentication flaw tracked as CVE-2026-57807 affects the miniOrange OAuth Single Sign On - SSO (OAuth Client) WordPress plugin and allows unauthenticated remote attackers to compromise vulnerable sites. The issue impacts plugin versions through 38.5.8 and is classified as CWE-288. According to public reporting and the CVE entry, the bug abuses the plugin's password recovery flow to let an attacker authenticate as arbitrary WordPress users, including administrators, creating a direct path to full website takeover.
The vulnerability carries a CVSS 9.8 rating and is considered low complexity and remotely exploitable with no user interaction required. Patchstack disclosed the issue and warned it is likely to face mass exploitation, while noting that no official vendor patch was available at the time of reporting. Defenders were urged to immediately remove the affected plugin or limit exposure to WordPress login and password recovery endpoints until miniOrange releases a fix; Patchstack also said it had issued a virtual patch for protected customers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE feed entry states that CVE-2026-57807 was newly received by Patchstack on July 10, 2026. The vulnerability was recorded as a broken authentication issue enabling password recovery exploitation in the miniOrange OAuth Single Sign On - SSO (OAuth Client) WordPress plugin through version 38.5.8.
Patchstack disclosed a critical broken authentication vulnerability, CVE-2026-57807, in the miniOrange WordPress OAuth Single Sign-On (SSO (OAuth Client)) plugin on July 9, 2026. The flaw affects versions through 38.5.8, no official vendor fix was available at the time, and Patchstack released a virtual patch while warning the issue was likely to be mass exploited.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, **CVE-2024-10924**, was disclosed and fixed in the WordPress plugin **Really Simple Security**, affecting the Free, Pro, and Pro Multisite editions in versions `9.0.0` through `9.1.1.1`. The flaw carries a **CVSS 9.8** rating and can allow an unauthenticated attacker to log in as any user, including an administrator, on sites where the plugin’s two-factor authentication feature is enabled. The issue was traced to improper error handling in the `check_login_and_get_user` function within the plugin’s two-factor authentication REST API. Defenders warned that roughly **4 million** websites could be exposed, making the bug a high-priority patching issue for WordPress operators. Site owners were urged to update immediately to **version 9.1.2 or later** to close the vulnerability.
Jul 24, 2026
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026
A **critical unauthenticated privilege-escalation vulnerability** in the *Modular DS* WordPress plugin is being **actively exploited in the wild** to obtain administrator access. The flaw, tracked as **CVE-2026-23550** (CVSS **10.0**), affects *all versions up to and including 2.5.1* and is fixed in **2.5.2**; the plugin is reported to have **40,000+ active installs**. The issue stems from the plugin’s routing/authentication design under the ` /api/modular-connector/ ` prefix, where attackers can bypass authentication middleware by forcing “direct request” handling using parameters such as `origin=mo` and an arbitrary `type` value, particularly when the site is already connected to Modular services (i.e., tokens are present/renewable). Exploitation leverages exposed routes including ` /login/ ` (notably ` /api/modular-connector/login/ ` / ` /login/{modular_request} `), enabling auto-login behavior that results in **administrator-level access** and potential full site compromise (e.g., data access, backups, management actions, and follow-on malware/persistence). Reporting also notes observed attacker behavior and indicators tied to exploitation attempts against the login endpoint (e.g., requests containing `origin=mo&type=foo`) and lists IPs associated with scanning and post-exploitation activity, including `45.11.89[.]19`, `162.158.123[.]41`, `172.70.176[.]95`, and `172.70.176[.]52`. Patch guidance emphasizes immediate upgrade to **2.5.2**, and mitigations include rules intended to block exploit patterns and hardening changes such as stricter route binding and `type` validation.
Jun 29, 2026