CVE-2026-12761 is an authentication bypass vulnerability in the miniOrange Social Login and Register plugin for WordPress. The vulnerability arises because the Profile Completion flow accepts an arbitrary email address via the 'email_field' POST parameter without verifying that the email belongs to the authenticated OAuth identity. Furthermore, the send_otp_token() function returns a SHA-512 hash of the concatenation of a static customer_key and the OTP to the client. The OTP is generated from a limited space of 99,000 values, making it feasible to crack the OTP offline quickly. An attacker can trigger an OTP email to an arbitrary admin's email, crack the OTP from the leaked hash, and submit it to the validation function, thereby logging in as that user and gaining full administrator access. This vulnerability affects versions up to and including 7.7.0. No official patch or remediation is currently documented.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and log in as any user, including administrators, resulting in full account takeover. This compromises confidentiality, integrity, and availability of the affected WordPress site. The CVSS v3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the affected plugin versions. Consider disabling the miniOrange Social Login and Register plugin or restricting its use to trusted users only. Monitor vendor channels for updates or patches addressing this vulnerability.