Critical WordPress OAuth Plugin Flaw Exposes Millions of Sites to Full Takeover A severe security vulnerability in the miniOrange OAuth Single Sign-On (SSO) plugin for WordPress has left millions of websites vulnerable to unauthenticated remote takeover. Tracked as CVE-2026-57807 with a CVSS score of 9.8, the flaw was disclosed by Patchstack on July 9, 2026, and classified under OWASP A7: Identification and Authentication Failures. The issue stems from a Broken Authentication weakness (CWE-288), specifically exploiting the plugin’s password recovery mechanism via an alternate authentication pathway. Attackers can bypass login controls without prior access, authentication, or user interaction, making exploitation trivial and low-complexity. All versions of the plugin up to and including 38.5.8 are affected. Successful exploitation allows attackers to impersonate any WordPress user, including administrators, leading to full site compromise. Potential consequences include malicious content injection, data exfiltration, backdoor installation, and lateral movement within the hosting environment. Patchstack warns the flaw is highly likely to be exploited in mass campaigns, targeting websites regardless of size or traffic. While no official patch has been released by miniOrange, Patchstack has issued a virtual patch to block attacks until a fix is available. Security researcher Kim Dvash reported the vulnerability on June 6, 2026, with the NVD publishing the CVE on July 10, 2026. Administrators are advised to deactivate and remove the plugin from exposed WordPress installations or restrict access to login and recovery endpoints via WAF rules or IP allowlisting as a temporary mitigation. Updates should be applied immediately upon release.