Loading...
CVE-2026-57807 lets a stranger log in to a WordPress site as the administrator — no password, no account, no user interaction. It scores 9.8 out of 10. And when it was published on July 10, there was no fix to install. The only safe move was removing the plugin entirely. That breaks the mental model most site owners run on, and it's worth understanding why.
A critical authentication bypass in miniOrange's OAuth Single Sign-On plugin for WordPress (CVE-2026-57807, CVSS 9.8) affects all versions up to 38.5.8 and lets unauthenticated attackers gain admin access through the password-recovery flow. Reported June 6, published by NVD July 10 — with no official patch available at disclosure. Guidance was to deactivate and remove the plugin. Sites with nobody watching security advisories had no way to know.
On July 10, 2026, the National Vulnerability Database published CVE-2026-57807: a critical flaw in miniOrange's OAuth Single Sign-On (SSO) plugin for WordPress. The vulnerability lets a complete stranger log in to an affected site as any user — including the administrator — with no password, no existing account, and no interaction from anyone on your end. It scores 9.8 out of 10 on the CVSS severity scale, about as bad as a web vulnerability gets.
The mechanics: the flaw is an authentication bypass (classified as CWE-288, "authentication bypass using an alternate path") that abuses the plugin's password-recovery flow. Instead of proving who they are, an attacker walks in through a side path the plugin never locked. Low complexity, launchable from anywhere on the internet, no special skills required.
Security researcher Kim Dvash reported the issue to the vendor on June 6. Every version of the plugin up to and including 38.5.8 is affected. And here is the detail that makes this incident different from the usual patch-day story: at public disclosure, there was no official fix. Patchstack shipped a virtual patch for its own customers, but for everyone else the published guidance was blunt — deactivate the plugin and remove it from any internet-facing site until the vendor ships a repaired release.
Almost all small-business website security runs on one mental model: vulnerabilities get discovered, vendors ship fixes, you install updates, you're safe. The whole routine — auto-updates, the weekly click on the Updates screen — assumes the fix always exists by the time you hear about the problem.
CVE-2026-57807 is what it looks like when that assumption fails. The window between disclosure and patch is the most dangerous period in a vulnerability's life, because attackers and defenders learn about the flaw at the same time — but only one side has to act. Attackers scan the entire internet for affected plugin versions within hours of a disclosure like this. Defenders, meanwhile, see nothing: no update notification appears, because there is no update. WordPress dashboards report "everything is up to date" on sites that are wide open.
That's the trap. An up-to-date site and a safe site are not the same thing, and the gap between them is exactly where incidents like this live. We saw a version of this pattern with the plugin flaws that dominated small-business hacks earlier this year — but those at least had patches. This one required an action no dashboard would ever prompt: removing a working, licensed, fully "updated" plugin.
An SSO plugin is not a slider or a contact form. It sits directly in the authentication path — the single most security-critical function a website has — and small businesses install plugins like this casually, often to solve a one-time login annoyance, then forget they exist.
That points to the deeper issue this incident exposes: most site owners don't actually know what is installed on their own site, what each piece does, or which pieces sit in positions where a single flaw means total takeover. When disclosure day comes, the owners who respond in hours are not the ones with the best plugins. They are the ones with three boring things in place:
None of that is software you can install. It's an operational capability — and it's precisely what most small business websites lack, as we've argued about DIY-platform security before.
If you run WordPress and are not sure whether this plugin — or anything like it — is installed:
There will be a next one. WordPress's plugin ecosystem is tens of thousands of vendors of wildly varying security maturity, and authentication-adjacent plugins are among the most valuable targets on the internet — one flaw yields thousands of admin panels. Some of those flaws will drop without patches. That is not a WordPress indictment; it's the reality of running any software system assembled from third-party parts.
The businesses that handle this reality well don't do it with heroics. They do it with an audit done once, honestly — what's installed, what's exposed, what's overdue for removal — and a watching function that never lapses. Everything else in website security is built on those two things.
The uncomfortable truth in CVE-2026-57807 is that the safest action — removing a plugin — is the one thing no automated system will ever do for you. Auto-updates can't remove software. Dashboards can't tell you a green checkmark is lying. On disclosure day, the only real defense was a human who knew the site, knew the advisory, and acted the same day.
Most small businesses have no idea whether their site would pass that test, because nobody has ever looked. That's fixable in an afternoon: a proper security review tells you what's installed, what's in the authentication path, what should be removed, and what needs watching. It is the cheapest insurance a website can buy — and after a disclosure like this one, the case for it makes itself.
👉 Get a plain-language security audit of your website or book a strategy call with Sitora.
Is CVE-2026-57807 patched yet? At public disclosure on July 10, 2026, there was no official fix — the published guidance was to deactivate the miniOrange OAuth Single Sign-On plugin and remove it from internet-facing sites. Before reinstalling, check the plugin's changelog or the NVD entry for CVE-2026-57807 to confirm the vendor has shipped a repaired release. Your WordPress dashboard cannot tell you this on its own.
Which plugin versions are affected by CVE-2026-57807? Every version of miniOrange's OAuth Single Sign-On plugin for WordPress up to and including 38.5.8. The flaw is an authentication bypass (CWE-288) that abuses the plugin's password-recovery flow, letting an unauthenticated attacker log in as any user — including the administrator — with no password and no existing account.
Is deactivating the plugin enough, or does it need to be removed? The published guidance was removal, not just deactivation. Removing the plugin takes the vulnerable code off the server entirely, so it can't be re-enabled by mistake — or invoked through a path nobody anticipated — while no fixed version exists.
How do I know if my site was already compromised through this flaw? The flaw grants admin access, so look for what an admin-level intruder leaves behind: admin accounts you don't recognize, recently modified files, and plugins you didn't install. If anything looks off, rotate every credential the site touches — admin passwords, database credentials, API keys — and treat the site as compromised until a proper review says otherwise.
Why didn't my WordPress dashboard warn me about this? Because there was no update to offer. Update notifications only exist once a vendor ships a fix, and at disclosure there wasn't one — so dashboards reported "everything is up to date" on sites that were wide open. An update status is not a security status. Knowing about a disclosure like this requires someone actually watching security advisories.
Every claim above that came from outside SitoraWeb is linked here. Check them.
If this article reflects the kind of problem you are solving, these are the most relevant next steps inside SitoraWeb.
Improve trust, search visibility, and lead quality with a custom website built around how buyers actually compare options.
Explore Website ServicesBuild secure portals, dashboards, internal tools, and customer-facing web apps that remove operational friction.
Explore Web App ServicesGet validation, workflow analysis, and a roadmap before you commit to the wrong build path.
Explore ConsultingThe rest of the blog covers search strategy, site architecture, analytics, automation, and common mistakes that slow down growth.