Miniorange Discord Integration Vulnerabilities

The miniOrange Discord Integration plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 2.2.4

Fixed in:

2.2.5

Disclosed:

Jul 22, 2026

CVE-2026-59545 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integration allows PHP Local File Inclusion. This issue affects miniOrange Discord Integration: from n/a through 2.2.2.

Affected:

up to 2.2.2

Fix:

No patched version reported

Disclosed:

May 23, 2025

CVE-2025-47672 on NVD →

The miniOrange Discord Integration plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.2.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to byp...

CVSS:

9.8

Affected:

up to 2.2.2

Fixed in:

2.2.3

Disclosed:

May 22, 2025

CVE-2025-47672 on NVD →

[en] The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example

Affected:

up to 2.1.6

Fixed in:

2.1.6

Disclosed:

Oct 17, 2022

CVE-2022-3082 on NVD →

The miniOrange Discord Integration plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on an several AJAX actions including 'mo_discord_check_capp_enable' and 'mo_discord_custom_app_enable_change_update' in versions up to, and including, 2.1.5. This makes it possible for authent...

CVSS:

6.5

Affected:

up to 2.1.5

Fixed in:

2.1.6

Disclosed:

Sep 22, 2022

CVE-2022-3082 on NVD →