Vulnerability Report

CVE-2023-2982

Title: Miniorange Wordpress Social Login And Register \(Discord\ Auth Bypass

Auth Bypass

Proof Of Concept

PoC Available for CVE-2023-2982

CWE Category NVD-CWE-noinfo
Published Date Jun 29, 2023
Modified Date Apr 08, 2026
Exploit Status Available
Score 9.8 CVSS v3.1
Exploit Probability (EPSS)
46.24%

Vulnerability Summary

CVE-2023-2982: The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.

Impacted Vendors

M
miniorange 1

Reference Links

https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/ https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107 https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openid https://plugins.trac.wordpress.org/changeset/2925914/miniorange-login-openid https://www.wordfence.com/threat-intel/vulnerabilities/id/08ca186a-2486-4a58-9c53-03e9eba13e66?source=cve https://lana.codes/lanavdb/2326f41f-a39f-4fde-8627-9d29fff91443/ https://plugins.trac.wordpress.org/browser/miniorange-login-openid/trunk/mo-openid-social-login-functions.php#L107 https://plugins.trac.wordpress.org/changeset/2924863/miniorange-login-openid https://plugins.trac.wordpress.org/changeset/2925914/miniorange-login-openid https://www.wordfence.com/threat-intel/vulnerabilities/id/08ca186a-2486-4a58-9c53-03e9eba13e66?source=cve
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2023-2982 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/RandomRobbieBF/CVE-2023-2982
View Code
GitHub https://github.com/H4K6/CVE-2023-2982-POC
View Code
GitHub https://github.com/wshinkle/CVE-2023-2982
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.