Security readout for executives and security teams
Plain-English summary
This is a critical authentication bypass in a WordPress single sign-on plugin from miniOrange. A vulnerable site could allow an unauthenticated attacker to bypass login protections, putting site content, accounts, and administration at serious risk. The source bundle does not include implementation details or a named fixed version.
Executive priority
Treat this as urgent for any business-critical WordPress site using the affected plugin. The risk is account and site compromise without prior credentials. Start with asset discovery, confirm versions, and follow vendor guidance before assuming a specific patch path.
Technical view
CVE-2022-34858 affects miniOrange OAuth 2.0 client for SSO WordPress plugin versions up to 1.11.3. It is classified as CWE-306, missing authentication for a critical function, with CVSS 3.1 score 9.8 and network, no-auth, no-user-interaction attack characteristics.
Likely exposure
Exposure is likely limited to WordPress sites using the miniOrange OAuth 2.0 client for SSO plugin at version 1.11.3 or earlier. Public-facing WordPress deployments are the primary concern because the CVSS vector indicates remote network reachability without credentials.
Exploitation context
The provided sources do not state active exploitation, and the CVE is not marked as CISA KEV. The CVSS vector indicates exploitation could be low-complexity and unauthenticated, but the bundle does not provide exploit mechanics, observed campaigns, or proof-of-concept status.
Researcher notes
The bundle provides severity, affected product, version boundary, CWE, CVSS vector, and public references, but not root-cause detail or a fixed version. Avoid asserting exploitation or remediation specifics beyond the cited sources. Validate exposure by plugin presence and version, then correlate with access logs.
Mitigation direction
- Inventory WordPress sites for the miniOrange OAuth 2.0 client for SSO plugin.
- Identify any plugin installations at version 1.11.3 or earlier.
- Check miniOrange and Patchstack guidance for a supported fixed or unaffected version.
- Disable or remove vulnerable installations if no vendor-supported fix is immediately available.
- Prioritize review of administrative accounts and SSO-related access controls.
Validation and detection
- Confirm each WordPress site’s installed plugin slug and version.
- Verify whether the plugin is enabled on public-facing production sites.
- Review authentication logs for unexpected logins or privilege changes.
- Check whether SSO behavior depends on this plugin before removal.
- Document remediation status for every affected WordPress instance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-34858 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/vulnerability/oauth-client/wordpress-oauth-2-0-client-for-sso-plugin-1-11-3-authentication-bypass-vulnerability?_s_id=cveCVE reference · vdb-entry
- https://lana.codes/lanavdb/df23b19f-4134-41d3-8cb3-9d44189b461b?_s_id=cveCVE reference · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.