While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.
If you spent last week patching WordPress against the wp2shell core flaw and exhaled, I have bad news: there was a second critical WordPress vulnerability disclosed the same week, and this one is arguably nastier to deal with — because there is no official patch to install. It's in miniOrange's OAuth Single Sign-On plugin, tracked as CVE-2026-57807, rated 9.8, and it lets a total stranger log into your site as an administrator. Updating WordPress core did nothing for it. If you run this plugin, the fix tonight is to turn it off.
Why 'no patch' changes your response
Most security advisories end with 'update to version X.' This one didn't. Researcher Kim Dvash reported it on June 6, 2026; Patchstack disclosed it publicly on July 9, and at that point miniOrange had not shipped a fixed release. Patchstack's own customers got a virtual patch — a firewall rule that blocks the exploit pattern — but if you're not behind that or an equivalent WAF, the vulnerable code is live on your site with no button to press.
That inverts the usual advice. With wp2shell, the answer was 'update immediately.' Here, updating isn't an option yet, so the only moves are removal or mitigation. I'd deactivate it. A login plugin you can't patch is a login plugin an attacker can walk through, and 'we'll wait for the fix' is a decision to stay exploitable for however long that takes.
The NVD entry: 9.8 CRITICAL, assigned by Patchstack, affecting miniOrange OAuth SSO through 38.5.8. · NIST National Vulnerability Database (screenshot)
How the bypass actually works
The technical class is an 'authentication bypass using an alternate path or channel' — the NVD description spells it out: the plugin exposes a login route that doesn't enforce the checks the normal one does. Specifically, it's the password-recovery mechanism that gets abused. An attacker doesn't need to guess a password or steal a session; they use the recovery flow as a side door to authenticate as an arbitrary user. Point it at an administrator account and they're in the dashboard.
What makes it a 9.8 rather than a merely-bad 7 is the attack profile. No authentication required. No user interaction. Low complexity, exploitable straight from the internet. That combination is the same one that made the PeopleSoft zero-day and wp2shell so urgent — when the prerequisites collapse to 'can reach the site over HTTP,' the vulnerability is effectively pre-weaponized.
CVE-2026-57807 at a glance
CVSS score
Detail
9.8 (Critical, per Patchstack)
Vulnerability class
Detail
Authentication bypass (alternate path)
Affected plugin
Detail
miniOrange OAuth SSO – OAuth Client
Affected versions
Detail
Through 38.5.8
Authentication required
Detail
None
Reported / disclosed
Detail
Jun 6 / Jul 9, 2026
Official patch at disclosure
Detail
No — virtual patch only
Detail
CVSS score
9.8 (Critical, per Patchstack)
Vulnerability class
Authentication bypass (alternate path)
Affected plugin
miniOrange OAuth SSO – OAuth Client
Affected versions
Through 38.5.8
Authentication required
None
Reported / disclosed
Jun 6 / Jul 9, 2026
Official patch at disclosure
No — virtual patch only
What to do tonight
Check whether you run miniOrange's OAuth SSO plugin and what version — anything at or below 38.5.8 is affected.
Deactivate it. If SSO is business-critical and you can't, put it behind a WAF with a rule blocking the recovery-path bypass, plus IP allowlisting on wp-login.
Audit your users list for accounts you don't recognise, especially new administrators — that's the first thing a takeover creates.
Rotate admin passwords and any API keys the site holds, in case access already happened.
Watch for an official miniOrange release and update the moment it ships — then you can re-enable safely.
Quick answers
I updated WordPress to 6.9.5. Am I safe from this?
No. That update fixes the wp2shell core vulnerability, not this plugin flaw. CVE-2026-57807 lives in miniOrange's OAuth SSO plugin code, which core updates don't touch. If you have the plugin installed at version 38.5.8 or below, it's still vulnerable until you deactivate it or an official plugin patch ships.
How do I know if I was already compromised?
Check your WordPress users list for unfamiliar accounts, especially administrators created recently. Review recent posts and pages for injected content, look for unexpected plugin or theme files, and check server logs for suspicious hits on the plugin's authentication endpoints. If you find anything, treat it as a full incident — a takeover rarely stops at one action.
Is there really no fix at all?
At disclosure there was no official miniOrange patch — Patchstack provided a virtual patch (a firewall rule) for its users. Check the plugin's changelog for a fixed release before assuming; vendors often ship one within days of public disclosure. Until you can confirm a patched version, deactivation is the safe posture.
Should I switch away from miniOrange entirely?
One vulnerability isn't proof a plugin is bad — every widely-used plugin gets CVEs, and a fast, transparent fix matters more than never having a bug. What I'd weigh is how they handle this one: a quick patched release and clear disclosure is reassuring; silence isn't. Judge them on the response, not the existence of the flaw.
Primary detail is on the NVD entry and in Patchstack's disclosure coverage. This is the second critical WordPress hole in a fortnight, and the pair make a useful point together: core flaws like wp2shell are rare but plugin flaws like this one are the constant background risk — which is why 'update WordPress' is necessary but never the whole job. If you want the companion piece, our 10-minute WordPress security audit covers what to check across both.
