The miniOrange Social Login and Register plugin’s profile completion process accepts any email supplied via the 'email_field' POST parameter without confirming that it matches the authenticated OAuth identity. When an OTP is requested, the plugin generates a SHA‑512 hash of the concatenated customer key (which is empty on new installs) and the OTP value. The OTP is chosen from a small range of 1000–99999, allowing an attacker to brute‑force the hash offline in fractions of a second, retrieve the original OTP, and submit it to the validation endpoint to establish a logged‑in session as the targeted email address, thereby gaining full administrative access.

The flaw affects all installations of the miniOrange Social Login and Register plugin for WordPress delivered by Cyberlord92 with version numbers up to and including 7.7.0. No evidence of a fix in newer releases is provided in the available data.

With a CVSS score of 9.8 the vulnerability is classified as critical. The EPSS score is reported as less than 1 % and the issue is not listed in CISA’s KEV catalog. The likely attack vector is a remote, unauthenticated HTTP POST request to the plugin’s profile completion endpoint: an attacker supplies an arbitrary administrator email, triggers an OTP email, cracks the leaked hash, and submits the OTP to the validation function, ultimately assuming the target’s administrator role.