Security readout for executives and security teams
Plain-English summary
This WordPress plugin flaw can let an outside attacker take over an administrator account without a password. The issue affects miniOrange Social Login and Register up to and including 7.7.0. A successful compromise could give full control of the WordPress site, including content, users, plugins, and stored data.
Executive priority
Treat as urgent for any affected WordPress site. The business impact is potential full website takeover without credentials. Prioritize inventory, update or disablement, and post-fix review for unauthorized administrator activity.
Technical view
The Profile Completion OTP flow accepts an arbitrary email address not tied to the OAuth identity. The OTP transaction hash is returned to the client, and the OTP space is small. Sources state this can allow unauthenticated login as the supplied email account, including administrators, in versions through 7.7.0.
Likely exposure
Internet-facing WordPress sites using miniOrange Social Login and Register versions up to and including 7.7.0 are the likely exposure. Risk is highest where the affected profile completion and OTP flow is reachable.
Exploitation context
The CVE describes unauthenticated, network-accessible administrator account takeover with low complexity and no user interaction. CISA KEV is not indicated in the provided sources, and no cited source here confirms active exploitation.
Researcher notes
The source bundle includes code references and a changeset supporting the described root cause. The affected metadata appears inconsistent, listing versions as “0” while the title and description state through 7.7.0. No active exploitation evidence is provided.
Mitigation direction
- Identify all WordPress sites using the affected miniOrange plugin.
- Upgrade beyond 7.7.0 if a vendor-provided fixed release is available.
- If no fixed release is available, follow vendor guidance or disable the plugin.
- Restrict administrative access and review WordPress administrator accounts.
- Monitor for unexpected admin logins or new privileged users.
Validation and detection
- Check installed plugin name and version on each WordPress site.
- Confirm whether version is 7.7.0 or earlier.
- Review plugin changelog or WordPress Trac changeset 3592642.
- Verify the profile completion OTP flow is not exposed on vulnerable versions.
- Inspect logs for unusual social-login or OTP-related administrator sessions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-12761 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9WordfenceVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineWordfence
Vendor Notified
- Source timelineWordfence
Disclosed
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a56b59ce-29c2-4172-b703-a06d7bb28da0?source=cveCVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/class-mo-openid-login-widget.php#L1502CVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/view/profile_completion/mo_openid_prof_comp_funct.php#L41CVE reference, Wordfence
- https://plugins.trac.wordpress.org/browser/miniorange-login-openid/tags/7.7.0/mo-openid-social-login-functions.php#L34CVE reference, Wordfence
- https://plugins.trac.wordpress.org/changeset/3592642/CVE reference, Wordfence
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.