The miniOrange Social Login and Register plugin before 7.8.0 suffers from improper authentication (CWE-287) due to the one-time code used in its optional Profile Completion email verification not being tied to the specific user account. An attacker can request a one-time code for an email address they control and then replay that code against a victim's email address, thereby obtaining a valid authenticated session for that victim's account. This vulnerability affects the social login integration for Discord, Google, Twitter, and LinkedIn. Exploitation requires the Profile Completion feature to be enabled and social login configured.

An attacker can gain unauthorized access to any user account, including administrator accounts, by exploiting the improper binding of the one-time verification code. This leads to a complete bypass of authentication controls for affected accounts, potentially allowing full control over the victim's WordPress site if an administrator account is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable the Profile Completion feature or social login configuration to prevent exploitation. Monitor vendor communications for updates and apply any official patches promptly once released.