Unauthenticated account takeover via unbound verification code

Authentication bypass in miniOrange Social Login and Register before 7.8.0 allows remote attackers to obtain any WordPress account session. The Profile Completion handler validates an email one-time code and transaction in the attacker's session without binding them to the submitted account email. With Profile Completion enabled and social login configured, an unauthenticated attacker can replay a code sent to an attacker-controlled address while naming a victim address, including an administrator's, and receive that account's login cookie.