EUVD-2026-69861
GHSA-f9w9-q3c6-p58g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
No back-channel verification means assertion forgery requires no special complexity once Steam SSO is active; A:N because account takeover does not constitute direct availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.
AnalysisAI
Authentication bypass in the OAuth Single Sign On WordPress plugin (versions 6.25.0 through <7.0.1) allows unauthenticated remote attackers to log in as any non-administrator WordPress user by forging the identity assertion returned during the Steam SSO flow, without possessing valid credentials. Attackers can additionally register entirely new accounts, providing persistent footholds. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Steam single sign-on flow must be explicitly configured and active within the OAuth Single Sign On plugin settings - WordPress sites that have not enabled Steam as an SSO provider are not exposed to this attack path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated network exploitation with high impact across all three pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the OAuth Single Sign On WordPress plugin to version 7.0.1 or later, the vendor-released patch confirmed by the affected version range in EUVD-2026-69861. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all WordPress instances using OAuth SSO plugin versions 6.25.0 through 7.0.0 and disable the plugin temporarily if immediate patching is not feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Oauth Single Sign On
View allImproper Authentication vulnerability in miniOrange OAuth Single Sign On - SSO (OAuth Client) plugin allows Authenticati
The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (Id
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today