Unbound Email Verification Code Enables Account Takeover

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-14300 is a critical authentication bypass vulnerability in the miniOrange Social Login and Register WordPress plugin affecting versions before 7.8.0. The flaw exists in the optional Profile Completion email-verification feature, which fails to cryptographically bind one-time verification codes to the specific account they were issued for. This allows unauthenticated attackers to request a verification code using any email address under their control, then replay that same code against a victim's account—including administrator accounts—to obtain a valid authenticated session. Organizations running affected WordPress installations with this plugin enabled face immediate risk of unauthorized administrative access, data exfiltration, and complete site compromise. The attack requires only that Profile Completion is activated, making it broadly exploitable across vulnerable deployments.

Casky's 283 mapped skills leverage Claude's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK's Initial Access (TA0004) and Credential Access (TA0006) tactics. Practitioners using Casky would identify suspicious patterns including: anomalous email verification requests originating from different IP addresses than the account owner, verification code reuse attempts across multiple accounts within short timeframes, and unusual session establishment following verification code generation—all indicators of code replay attacks. The platform's skill mapping correlates these behavioral signals with CWE-287 (Improper Authentication) root causes, enabling security teams to spot exploitation attempts in access logs, plugin audit trails, and authentication events. Detection would surface suspicious verification workflows, cross-account code reuse, and administrative session creation from unexpected origins, allowing practitioners to respond before attackers establish persistent access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14300.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-14300

Casky has 283 skills that investigate the attack patterns behind CVE-2026-14300. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn