WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerability

Description

Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.

Affected Products

Vendor	Product	Versions
miniorange	oauth single sign on – sso (oauth client)	n/a

References

https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-0-0-broken-authentication-vulnerability?_s_id=cve(vdb-entry)

Related News (1 articles)

Tier C

VulDB12d ago

CVE-2026-28008 | miniOrange OAuth Single Sign On Plugin up to 7.0.0 on WordPress improper authentication

→ No new info (linked only)

CVSS 3.19.8 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

CWECWE-290

PublishedAug 13, 2026

Trending Score11

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-61979EXPKEV

WordPress SAML SP Single Sign On plugin <= 5.4.3 - Privilege Escalation vulnerability

Trending: 119

CRITICALCVE-2026-28148

WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability

Trending: 11

CRITICALCVE-2026-61967

WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability

Trending: 11

CRITICALCVE-2026-28149

WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability

Trending: 11

HIGHCVE-2026-73351

WordPress WordPress Social Login and Register plugin <= 7.8.1 - Cross Site Scripting (XSS) vulnerability

Trending: 10

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 13, 2026

Discovered by ZDM

Aug 13, 2026