CVE-2026-12761 is an authentication bypass vulnerability in the miniOrange Social Login and Register WordPress plugin (versions <=7.7.0). The vulnerability arises because the Profile Completion flow accepts an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the OAuth provider's identity. Additionally, the send_otp_token() function returns a SHA-512 hash of a static customer_key concatenated with an OTP to the client, where the OTP is a 5-digit number with only 99,000 possible values. Because the customer_key is static and sometimes empty, an attacker can brute force the OTP offline quickly. By submitting the cracked OTP to the validation function, the attacker can log in as the user associated with the supplied email, including administrators, resulting in full account takeover.

Successful exploitation leads to complete account takeover, including administrator accounts, without requiring any prior authentication or user interaction. This compromises confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the affected plugin versions or disable the plugin to prevent exploitation.