CVE-2024-11087: The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This

high Affects social-login (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2025-03-08; advisory modified 2026-06-17.

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This

Package: social-login (WordPress plugin) WordPress
Affected versions: <=200.3.9
Fixed in: no fix recorded
Severity: high CVSS 8.1
Exploitation: not on CISA KEV · EPSS 0% (40.3th percentile)
Published: 2025-03-08
Source: nvd

References

CWE-287

NVD record social-login (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2024-10020 high The Heateor Social Login WordPress plugin for WordPress is vulnerable to authentication by same package: social-login (WordPress plugin)
CVE-2024-24712 medium Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulne same package: social-login (WordPress plugin)
CVE-2021-32648 KEV high Account Takeover in Octobercms same weakness: CWE-287
CVE-2018-12613 high phpMyAdmin Improper Authentication same weakness: CWE-287
CVE-2018-3810 critical Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before same weakness: CWE-287
CVE-2023-28121 critical An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an same weakness: CWE-287