The miniOrange WordPress Social Login and Register plugin versions up to 7.7.0 suffer from an improper control of filename for include/require statements in PHP, leading to a Local File Inclusion vulnerability. This allows an attacker with at least high privileges to include arbitrary files on the server, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability is network exploitable but requires high attack complexity and privileges, with no user interaction needed. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, code execution, or denial of service on the affected WordPress site. The CVSS vector indicates high impact on confidentiality, integrity, and availability. However, exploitation requires high privileges and network access, which limits the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and ensure that only trusted users have high privileges. Monitor for updates from miniOrange regarding patches or mitigations.