CVE-2024-11087 is a high severity (CVSS 8.1) authentication bypass in the miniOrange Social Login and Register Pro Addon plugin for WordPress, in versions up to and including 200.3.9. An attacker who knows a username can log in as that user, even an administrator. Update from the vendor or remove the addon.
What's affected
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon, all versions up to and including 200.3.9.
The record does not name a fixed version. Check the miniOrange site and the plugin changelog for a release newer than 200.3.9 before relying on any update.
How to check if you're exposed
Run the command below from the WordPress root with WP-CLI, or check the Plugins or Themes screen in the dashboard. Check staging, development and multisite networks too.
wp plugin list --format=table | grep -i social
Compare the version shown to the affected range above. If you manage many sites, run the same check on each one.
What to do now
- Confirm whether the plugin is active and whether social login is switched on for your login page. If you do not use social login, deactivate and delete the addon.
- Check whether any administrator accounts exist without a linked social identity. The record says the attack works when the targeted user has no existing account for the service returning the token, so those accounts matter most.
- Consider requiring a second factor on administrator accounts so a bypassed first step is not enough.
- Look up CVE-2024-11087 on its Gold page to see the current details and any fix information.
- Scan your sites again after changes. Our free in-browser dependency scan covers package manifests such as package.json and requirements.txt, so use it for the build tooling around your site as well.
Why it matters
The record ties the flaw to insufficient verification of the user returned by the social login token. In plain terms, the site trusted the identity that came back from the login provider without checking that it really belonged to the account being opened. The attack is rated as high complexity because the attacker needs to know a valid username, but usernames are often easy to find on WordPress sites through author pages.
This CVE is an authentication bypass (CWE-287, Improper Authentication). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Authentication bypass bugs skip the one question a login system exists to answer: who is this person. When the check on the identity is weak or missing, the rest of the access control model stops mattering, because the attacker simply arrives as someone who is allowed in.
For a content site or store the worst case is an administrator session. An admin can install plugins, edit files and create accounts, so a login bypass is often one step from full site control. Fixing it means verifying identity on the server, every time, against something the visitor cannot choose.
Quick check
Does this need a login first?
No. The CVSS vector lists no privileges required and no user interaction, though attack complexity is rated high. The attacker needs a valid username.
Is there a free version that is also affected?
The record names the Pro Addon only. Check the vendor advisory for any other editions you run.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
