{"id":"CVE-2026-120844","kind":"vulnerability","aliases":["CVE-2026-120844"],"related":[],"title":"WordPress OAuth SSO plugin: privilege escalation through incorrect role assignment","description":"Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.","summary":"The miniOrange OAuth Single Sign On WordPress plugin assigns privileges incorrectly during login, allowing privilege escalation. An attacker can gain higher access rights on a WordPress site than they should have.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["miniorange-oauth-sso","package","self-hosted","wordpress"],"not_affected_if":["newer-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the miniOrange OAuth Single Sign On (OAuth Client) plugin in the WordPress admin plugin list, looking for versions through `7.1.3`.\n- Review the site's user list for unexpected administrator or elevated-role accounts.","fix":"- OAuth Single Sign On – SSO (OAuth Client) for WordPress: versions after `7.1.3` (exact fixed version unknown from the sources).","status":"open","published_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:23+00:00","updated_at":"2026-11-06T08:42:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:23Z","model":"claude-haiku-5-5","output":{"fix":"- OAuth Single Sign On – SSO (OAuth Client) for WordPress: versions after `7.1.3` (exact fixed version unknown from the sources).","reach":"internet","title":"WordPress OAuth SSO plugin: privilege escalation through incorrect role assignment","impact":"high","summary":"The miniOrange OAuth Single Sign On WordPress plugin assigns privileges incorrectly during login, allowing privilege escalation. An attacker can gain higher access rights on a WordPress site than they should have.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","miniorange-oauth-sso","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker gains elevated WordPress privileges, possibly administrator access","analyst_note":"Confirm the first fixed version and the exact trigger conditions from the NVD or Wordfence entry for CVE-2026-120844.","how_to_check":"- Check the installed version of the miniOrange OAuth Single Sign On (OAuth Client) plugin in the WordPress admin plugin list, looking for versions through `7.1.3`.\n- Review the site's user list for unexpected administrator or elevated-role accounts.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","newer-version"],"who_is_affected":"WordPress sites with the miniOrange OAuth Single Sign On (OAuth Client) plugin installed at version 7.1.3 or earlier are exposed when SSO login is in use. Sites without this plugin, or with it removed or on a later version, are not affected. The sources do not state the exact trigger conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":4250,"output_tokens":639,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-120844':13A,16A '-2026':12A,15A '7.1.3':89C 'access':47B 'affect':78C 'allow':39B,74C 'assign':10A,34B,55C 'attack':43B 'client':65C,85C 'cve':11A,14A 'escal':6A,41B 'escalation.this':76C 'eve':70C 'facebook':73C 'gain':45B 'googl':72C 'higher':46B 'host':24B 'incorrect':8A,36B,53C 'issu':77C 'login':38B,68C 'miniorang':18B,27B,58C,67C 'miniorange-login-with-eve-online-google-facebook':66C 'miniorange-oauth-sso':17B 'n/a':87C 'oauth':2A,19B,28B,59C,64C,79C,84C 'onlin':71C 'packag':21B 'plugin':4A,33B 'privileg':5A,35B,40B,54C,75C 'right':48B 'role':9A 'self':23B 'self-host':22B 'sign':30B,61C,81C 'singl':29B,60C,80C 'site':52B 'sso':3A,20B,63C,83C 'vulner':56C 'wordpress':1A,25B,32B,51B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the miniOrange OAuth Single Sign On (OAuth Client) plugin installed at version 7.1.3 or earlier are exposed when SSO login is in use. Sites without this plugin, or with it removed or on a later version, are not affected. The sources do not state the exact trigger conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","miniorangeoauthsso","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-120844':13A,16A '-2026':12A,15A 'assign':10A 'cve':11A,14A 'escal':6A 'incorrect':8A 'oauth':2A 'plugin':4A 'privileg':5A 'role':9A 'sso':3A 'wordpress':1A","search_b":"'access':47B 'allow':39B 'assign':34B 'attack':43B 'escal':41B 'gain':45B 'higher':46B 'host':24B 'incorrect':36B 'login':38B 'miniorang':18B,27B 'miniorange-oauth-sso':17B 'oauth':19B,28B 'packag':21B 'plugin':33B 'privileg':35B,40B 'right':48B 'self':23B 'self-host':22B 'sign':30B 'singl':29B 'site':52B 'sso':20B 'wordpress':25B,32B,51B","search_c":"'7.1.3':89C 'affect':78C 'allow':74C 'assign':55C 'client':65C,85C 'escalation.this':76C 'eve':70C 'facebook':73C 'googl':72C 'incorrect':53C 'issu':77C 'login':68C 'miniorang':58C,67C 'miniorange-login-with-eve-online-google-facebook':66C 'n/a':87C 'oauth':59C,64C,79C,84C 'onlin':71C 'privileg':54C,75C 'sign':61C,81C 'singl':60C,80C 'sso':63C,83C 'vulner':56C","first_public_at":"2026-11-06T08:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120844","severity":null,"published_at":"2026-11-06T08:17:19+00:00","modified_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}