Critical
Privilege Escalation in MiniOrange OAuth Plugin
WordPress
What happened
There is a privilege escalation vulnerability in the MiniOrange OAuth Single Sign On plugin that could allow an attacker to gain unauthorized access to certain features.
Are you affected?
MiniOrange OAuth Single Sign On – SSO (OAuth Client) plugin versions 7.1.3 and earlier may be affected.
What to do now
- Upgrade to version 7.1.4 or later.
- Review your user privileges and access controls.
- Monitor your application for any unusual activity.
Sources
- cve.now/CVE-2026-120844
- CVE-2026-120844
- https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-1-3-privilege-escalation-vulnerability?_s_id=cve
- cve.now/GHSA-7mfr-2gjx-xqcx
- GHSA-7mfr-2gjx-xqcx
- https://nvd.nist.gov/vuln/detail/CVE-2026-120844
Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.
This product uses data from the NVD API but is not endorsed or certified by the NVD.
Not sure if your app is affected?
Get a free Finish Line Scan and a senior engineer will tell you what to fix.
Get a free scan