The vulnerability arises because the miniOrange Social Login and Register plugin, in versions before 7.8.0, does not tie the one‑time code issued during its optional email‑verification (Profile Completion) feature to the specific user account for which the code was generated. An attacker who controls an email address can request a code for that address, capture the one‑time code, and then replay it against the email address of any target user on the site, including administrators, creating a valid session token. This flaw permits unauthenticated account takeover and allows an attacker to gain full account privileges without any password. The weakness corresponds to CWE‑287: Improper Authentication.

WordPress users running the miniOrange Social Login and Register plugin before version 7.8.0 are affected. The flaw exists only when the Profile Completion feature is enabled and social login is configured. The plugin is distributed by miniOrange and is used in WordPress sites that integrate social login via Discord, Google, Twitter, and LinkedIn.

The vulnerability has a CVSS score of 8.1, indicating high severity. The EPSS score of less than 1% shows a low current exploitation probability, and the issue is not listed in CISA KEV. Successful exploitation requires an attacker to be able to control an email address and to be able to trigger the Profile Completion feature on the target site, after which the attacker can replay the unused one‑time code to obtain a session. Because the attack is unauthenticated and can target any user, including administrators, the risk to organizations leveraging this plugin is high if the feature is enabled. The risk can be mitigated by disabling or removing the vulnerable feature or by updating the plugin to a fixed version.