Security notice
Use miniOrange OAuth Single Sign On on WordPress? An unauthenticated privilege escalation flaw is fixed in 7.1.4. Update today.
miniOrange OAuth Single Sign On - SSO (OAuth Client) versions 7.1.3 and earlier have CVE-2026-120844, an unauthenticated privilege escalation flaw. Someone without a login can gain permissions they should not have. Patchstack lists this as unauthenticated privilege escalation. Update to 7.1.4 or later today. If you cannot update, deactivate the plugin until you can. (Patchstack, CVE record)
What happened
- The flaw. CVE-2026-120844 affects miniOrange OAuth Single Sign On - SSO (OAuth Client) through 7.1.3. Someone without a login can gain permissions they should not have. Patchstack lists this as unauthenticated privilege escalation. (Patchstack, CVE record)
- The fix. Patchstack lists 7.1.4 as the patched version. Update to that version or later. (Patchstack)
- Severity. CVSS 9.8 (Patchstack). Patchstack rates this CVSS 9.8 and medium priority. Its advisory says it is expected to become exploited; that is a risk warning, not confirmation of attacks. (Patchstack, CVE record)
Who should worry
This applies to sites with the OAuth Single Sign On - SSO (OAuth Client) plugin installed at 7.1.3 or earlier. It is the miniOrange plugin with WordPress.org slug miniorange-login-with-eve-online-google-facebook, not every plugin with SSO in its name. (CVE record)
WordPress.org lists 6,000+ active installations. That is a plugin installation count, not a count of affected or compromised sites. (WordPress.org)
What to do now
- Update to 7.1.4 or later today. Back up the site and database first, then update the plugin through WordPress. (Patchstack)
- If the update has to wait, deactivate the plugin until you can install the fixed version. Check which forms or login features this pauses before leaving the site unattended.
- Check accounts and files. Review user accounts and their roles. Investigate unexpected administrators or accounts whose permissions changed without your approval. Updating closes the flaw; it does not undo access an attacker may already have gained.
- Test the site. Check the pages that use this plugin after updating.
What to send your developer, agency or host
Please check whether our WordPress site runs miniOrange OAuth Single Sign On - SSO (OAuth Client). CVE-2026-120844 affects versions 7.1.3 and earlier; it is an unauthenticated privilege escalation flaw, fixed in 7.1.4+. This applies to sites with the OAuth Single Sign On - SSO (OAuth Client) plugin installed at 7.1.3 or earlier. It is the miniOrange plugin with WordPress.org slug miniorange-login-with-eve-online-google-facebook, not every plugin with SSO in its name. Please update today, or deactivate until the update can be installed. Review user accounts and their roles. Investigate unexpected administrators or accounts whose permissions changed without your approval. Please confirm the version you left us on. Sources: Patchstack, CVE record.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow Patchstack, the CVE record and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-120844, affected through 7.1.3, fixed in 7.1.4, published November 4, 2026.
- CVE record: CVE-2026-120844. Patchstack-assigned record.
- WordPress.org: plugin version information and 6,000+ active installations.