OAuth Single Sign On CVE-2026-82183

The Steam single sign-on flow must be explicitly configured and active within the OAuth Single Sign On plugin settings - WordPress sites that have not enabled Steam as an SSO provider are not exposed to this attack path. The attacker must be able to reach the WordPress login endpoint and initiate the Steam OpenID callback. Exploitation is hard-limited to non-administrator accounts; the plugin description explicitly states administrator accounts cannot be impersonated via this vector. Targeting a specific existing user requires knowledge of their Steam ID or associated username, though arbitrary new account creation requires no such knowledge and is unrestricted. No authentication, special network position, or user interaction is required beyond network access to the WordPress instance.

The vendor CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects unauthenticated network exploitation with high impact across all three pillars. The AC:H designation is the most debatable metric: if the plugin performs no assertion verification at all, practical exploitation complexity may be lower than AC:H suggests, making this an underestimated severity. The A:H component appears overstated - account takeover and unauthorized account creation do not directly cause availability loss in the classic sense; this should be treated as a metadata concern in risk modelling. More significantly, a publicly available proof-of-concept exploit from WPScan substantially closes the gap between theoretical and real-world risk regardless of CVSS score. The vulnerability is constrained to non-administrator accounts, so direct site administration compromise is not achievable through this vector alone; however, hijacked user sessions or silently created attacker-controlled accounts provide footholds for further privilege escalation via other plugin vulnerabilities or data harvesting. No CISA KEV listing was identified at time of analysis, and no EPSS data was provided in the input - exploitation scope is therefore inferred rather than confirmed.

An attacker identifies a WordPress site running OAuth Single Sign On with Steam SSO enabled, initiates a Steam login flow, and then crafts or replaces the OpenID assertion callback to assert the identity of a known non-administrator account. Because the plugin does not perform back-channel verification with Steam's servers, it accepts the forged claim and creates an authenticated session for the targeted account. A public proof-of-concept exploit from WPScan lowers the skill threshold for exploitation, making opportunistic attacks against unpatched sites straightforward.