CVE-2025-47707

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Miniorange 2fa

CVE-2025-47708

Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Miniorange 2fa

CVE-2025-47709

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055

Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Miniorange 2fa

CVE-2025-47710

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Miniorange 2fa

CVE-2022-3082

miniOrange Discord Integration < 2.1.6 - Subscriber+ App Disabling

The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Discord Integration

CVE-2023-6036

Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Miniorange

Products

Web3 - Crypto Wallet Login \& Nft Token Gating

CVE-2023-4238

Prevent files / folders access < 2.5.2 - Admin+ Arbitrary File Upload

The Prevent files / folders access WordPress plugin before 2.5.2 does not validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.

CVSS 3.1 · 7.2 High EPSS 1.6% KEV · Not listed

Vendors

Miniorange

Products

Prevent Files \/ Folders Access

CVE-2022-4200

Login with Cognito <= 1.4.8 - Admin+ Stored XSS

The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Login With Cognito

CVE-2023-23749

Extension - miniorange - LDAP Integration - LDAP Injection (username)

The 'LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login' extension is vulnerable to LDAP Injection since is not properly sanitizing the 'username' POST parameter. An attacker can manipulate this paramter to dump arbitrary contents form the LDAP Database.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Ldap Integration With Active Directory And Openldap

CVE-2022-4496

miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login

The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multisite WordPress plugin version 20.0.0 before 20.0.7 does not validate that the redirect parameter to its SSO login endpoint points to an internal site URL, making it vulnerable to an Open Redirect issue when the user is already logged in.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Saml Sp Single Sign On

CVE-2022-34858

WordPress OAuth 2.0 client for SSO plugin <= 1.11.3 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin <= 1.11.3 at WordPress.

CVSS 3.1 · 9.8 Critical EPSS 1.8% KEV · Not listed

Vendors

Miniorange

Products

Oauth 2.0 Client For Sso

CVE-2022-34149

WordPress WP OAuth Server plugin <= 3.0.4 - Authentication Bypass vulnerability

Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed

Vendors

Miniorange

Products

Wp Oauth Server

CVE-2022-42461

WordPress miniOrange's Google Authenticator plugin <= 5.6.1 - Broken Access Control vulnerability

Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Google Authenticator

CVE-2022-45073

WordPress REST API Authentication plugin <= 2.4.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Wordpress Rest Api Authentication

CVE-2023-23710

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Wordpress Social Login And Register \(discord\, Google\, Twitter\, Linkedin\)

CVE-2023-1093

OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF

The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Oauth Single Sign On

CVE-2023-1092

OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Oauth Single Sign On

CVE-2023-0812

Active Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data Disclosure

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Active Directory Integration \/ Ldap Integration

CVE-2023-23706

WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Wordpress Social Login And Register \(discord\, Google\, Twitter\, Linkedin\)

CVE-2022-2133

OAuth Single Sign On < 6.22.6 - Authentication Bypass

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Miniorange

Products

Oauth Single Sign On