EUVD-2026-43028
GHSA-x77p-gjm6-3v9r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running miniOrange OAuth SSO ≤38.5.8
-
DeliverySend crafted password-recovery request
-
ExploitBypass authentication via alternate channel
-
ExecutionObtain admin session
-
PersistInstall web shell or malicious plugin
-
ImpactFull site and server compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Exploitation requires that the target WordPress site have the miniOrange OAuth Single Sign On - SSO (OAuth Client) plugin installed and active at version 38.5.8 or earlier, with its password-recovery / alternate authentication path reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no privileges, and no user interaction are needed against such an installation. The primary limiting factor is deployment scope: sites without this specific plugin (or already on a fixed release) are unaffected, and any WAF or access control fronting the authentication endpoints reduces reachability. The exact request sequence for the password-recovery channel is not detailed in the source data and should be confirmed from the Patchstack advisory. |
| Impact | All available signals point to a genuine high priority rather than an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) describes fully remote, unauthenticated, low-complexity exploitation with total confidentiality, integrity, and availability impact - consistent with an authentication bypass that yields account/administrator takeover on WordPress. No EPSS probability, KEV entry, SSVC decision, or POC reference was provided in the input, so exploitation likelihood cannot be quantified and none is confirmed in the wild. The main uncertainty is the exact mechanism: the description only names 'Password Recovery Exploitation' as the alternate channel without detailing the request flow, so the precise trigger must be confirmed from the Patchstack advisory. On balance, an unauthenticated admin-takeover flaw in an internet-facing WordPress authentication plugin warrants urgent remediation regardless of the missing EPSS/KEV data. |
| Exploit ScenarioDerived | An attacker who can reach the WordPress site over the network sends crafted requests to the plugin's password-recovery / alternate authentication channel and, without supplying valid credentials, obtains an authenticated session as an administrator. From there they install a malicious plugin or web shell to achieve full site and server compromise. No public exploit code is identified yet, but the network vector and low complexity make weaponization straightforward once the flaw is understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 10, 2026
Authentication bypass in the miniOrange OAuth Single Sign On - SSO (OAuth Client) WordPress plugin (versions up to and including 38.5.8) lets remote unauthenticated attackers abuse an alternate authentication path in the password-recovery flow to log in as arbitrary users, including administrators. Rated CVSS 9.8, the flaw grants full account takeover without credentials or user interaction; there is no public exploit identified at time of analysis, but the plugin's SSO role and low attack complexity make it a high-value target.
RemediationAI
No vendor-released fixed version is identified in the provided data, so upgrade to any release later than 38.5.8 once miniOrange publishes it and confirm the exact patched version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/miniorange-oauth-oidc-single-sign-on/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-38-5-8-broken-authentication-vulnerability before relying on it. Until a patched build is confirmed, reduce exposure by restricting access to the plugin's authentication and password-recovery endpoints at the web server or WAF layer (Patchstack offers a virtual patch for subscribers), disabling the plugin if SSO is not business-critical, and enforcing strong administrator credentials plus monitoring for unexpected logins or password-reset activity - noting that WAF rules may break legitimate SSO callbacks and disabling the plugin will interrupt federated login. Audit administrator accounts and active sessions for signs of unauthorized access as a precaution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress plugin that acts as an OAuth 2.0 / OpenID Connect client, allowing WordPress sites to delegate login to external identity providers (Google, Azure AD, Okta, Keycloak, etc.). The vulnerability is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel: the plugin exposes a secondary authentication route - here tied to password recovery - that fails to enforce the same identity verification as the primary login path. Because SSO plugins sit directly on the authentication boundary and often run with the ability to create sessions for any local account, a logic gap in an alternate channel effectively defeats the entire login control. The single CPE, cpe:2.3:a:miniorange_security_software_pvt_ltd.:oauth_single_sign_on_-_sso_(oauth_client):*, covers all versions from an unspecified start through 38.5.8.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network-reachable auth bypass (AV:N/AC:L/PR:N/UI:N) yielding administrator takeover gives full control of the site, so C:H/I:H/A:H.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Security Software Pvt Ltd. OAuth Single Sign On - SSO (OAuth Client) allows Password Recovery Exploitation.
This issue affects OAuth Single Sign On - SSO (OAuth Client): from n/a through 38.5.8.
Executive ViewAI
A critical authentication bypass in miniOrange OAuth SSO WordPress plugin (versions ≤38.5.8) allows unauthenticated attackers to gain arbitrary account access, including administrator privileges, via an exploitable password-recovery flow. Organizations using this plugin face immediate risk of full WordPress infrastructure compromise without code injection or user interaction. With no vendor patch currently available and a 9.8 CVSS score, this represents a severe threat to identity-layer security across all dependent systems.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable plugin if operationally feasible; (2) Implement additional MFA at application or proxy layer to enforce step-up authentication for admin and sensitive accounts; (3) Deploy WAF rules to block anomalous access to password-recovery endpoints; (4) Enable comprehensive authentication logging and implement behavioral alerting for impossible-travel or off-hours admin logins; (5) Restrict plugin file permissions to read-only; (6) Segment SSO infrastructure on network to limit blast radius.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB