What is the CVSS score of CVE-2026-7617?

CVE-2026-7617 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Secufor OAuth CVE-2026-7617

EUVD-2026-38667 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-rcgx-vphg-9xcg

WordPress Authentication Bypass Wordpress Plugin Secufor Oauth

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible with no privileges or interaction required; impact limited to clearing OAuth configuration yielding only low integrity loss with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 07:03 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 5.3

DescriptionCVE.org

The Secufor_OAuth plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to disconnect the WordPress site from its linked Secufor account by clearing the plugin's stored login token and user login configuration.

AnalysisAI

Unauthenticated remote attackers can disconnect any WordPress site running the Secufor_OAuth plugin from its linked Secufor identity account by triggering an unprotected action handler that clears the stored OAuth token and login configuration. All plugin versions through 1.0.7 are affected, confirmed by Wordfence and traceable to specific lines in the plugin source. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, though the trivially low attack complexity (AV:N/AC:L/PR:N) means exploitation requires only an HTTP request.

Technical ContextAI

The Secufor_OAuth WordPress plugin (CPE: cpe:2.3:a:secufor:secufor_oauth:*:*:*:*:*:*:*:*) provides OAuth-based authentication bridging between WordPress sites and the Secufor identity platform. CWE-862 (Missing Authorization) is the root cause: the plugin's action handler at secuforoauth_login.php lines 212 and 220 executes a privileged state-clearing operation without first verifying that the requesting user holds appropriate capabilities. WordPress plugin security convention requires gating such operations with capability checks (current_user_can()) and nonce verification (check_ajax_referer()); the absence of both allows any unauthenticated HTTP client to trigger the token-clearing logic. The affected code is directly visible in the WordPress plugin Trac repository at both the trunk and the 1.0.7 tagged release.

RemediationAI

No patched version has been identified in the provided data - all references point exclusively to the vulnerable 1.0.7 tag with no newer release referenced. Administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/61293c20-cabe-412d-94d1-1d0326d35a46?source=cve for patch availability. As an immediate compensating control, disabling or deactivating the Secufor_OAuth plugin entirely eliminates the attack surface with no impact on WordPress core; the trade-off is loss of OAuth-based login until a patched version is available. Alternatively, restricting unauthenticated POST requests to wp-admin/admin-ajax.php at the web server or WAF level - specifically those invoking the plugin's token-clearing action hook - reduces exposure, though identifying the exact action parameter requires inspection of the plugin source at lines 212 and 220. Requiring authentication for all admin-ajax.php requests is a broader control with potential side effects on other plugins that legitimately serve unauthenticated AJAX requests.