Loading vulnerability…
Password-recovery authentication bypass in miniOrange OAuth Single Sign On
CVE-2026-57807 is an authentication-bypass vulnerability in miniOrange’s WordPress OAuth Single Sign On - SSO (OAuth Client) plugin affecting versions through 38.5.8. Improper validation of authentication requests in the password-recovery workflow reportedly allows an unauthenticated remote attacker to authenticate as any WordPress user, including administrators, without user interaction. Exploitation can result in complete takeover of the affected website.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits user and administrator impersonation, potentially giving an attacker full control of the affected WordPress website. Potential consequences include data theft, malicious-content injection, backdoor installation, and compromise of site confidentiality, integrity, and availability. Further attacks within the hosting environment are described as possible, but their prerequisites and extent are unspecified.
If you can’t patch tonight, do this now.
Deactivate or remove vulnerable plugin versions, particularly on internet-exposed installations. If removal is not feasible, restrict access to login and password-recovery endpoints using WAF rules or IP-based allowlisting. Patchstack reportedly provides a virtual patch to block exploitation attempts pending a vendor fix. Monitor for signs of compromise and vendor security updates.
Patch, then assume compromise.
Upgrade OAuth Single Sign On - SSO (OAuth Client) to a vendor-fixed release newer than 38.5.8. No specific fixed version is identified. Earlier reporting stated that an official vendor patch was unavailable at that time, whereas the advisories recommend upgrading beyond 38.5.8; verify the vendor’s release notes before selecting an update. If a confirmed fixed release is unavailable, deactivate and remove the vulnerable plugin.
No public exploits tracked yet. Mallory keeps watching.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.