EUVD-2026-89923
GHSA-jw8j-v42v-fh3c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WordPress OAuth SSO login endpoint
-
DeliverySend crafted authentication request
-
ExploitBypass OAuth identity verification (CWE-290)
-
ExecutionObtain authenticated session as target user
-
ImpactAccess/control WordPress account and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' plugin (version 7.1.2 or earlier) to be installed and active on a WordPress site with the OAuth/SSO login flow enabled and reachable. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no special non-default configuration beyond having the SSO login feature in use are required - exploitation is remote and unauthenticated against a reachable login endpoint. The primary limiting factor is that the site must actually deploy this OAuth client plugin for SSO, which is a specialized (not universal) WordPress feature. |
| Impact | This is a high-priority issue that should be treated as serious. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) describes remote, network-based exploitation requiring no privileges, no user interaction, and low attack complexity - the worst-case profile. CWE-290 (Authentication Bypass by Spoofing) combined with the description ('Unauthenticated Bypass') indicates an attacker can defeat the SSO/OAuth authentication flow to gain authenticated access, which for a WordPress login plugin plausibly means logging in as an arbitrary/privileged user. No EPSS score, KEV listing, or public POC is provided in the input, so despite the critical CVSS there is currently no confirmed evidence of active exploitation or weaponization - the 9.8 reflects theoretical impact, not observed attacks. The absence of a public exploit tempers immediate urgency somewhat, but authentication-bypass flaws in SSO plugins are attractive targets and Patchstack-reported WordPress plugin bugs are frequently reverse-engineered from patches; the fix is available (versions after 7.1.2), so patching should be prioritized. |
| Exploit ScenarioDerived | A remote unauthenticated attacker crafts a request against the miniOrange OAuth Client SSO login endpoint that bypasses the identity-verification step of the OAuth flow (e.g., forging or omitting token/identity validation), causing WordPress to authenticate them as a legitimate - potentially administrative - user. This yields full account takeover without any credentials or user interaction. No public proof-of-concept is identified at time of analysis, but the flaw class is straightforward to exploit once details are known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
The miniOrange 'OAuth Single Sign On - SSO (OAuth Client)' WordPress plugin, versions 7.1.2 and earlier, can be tricked into accepting a spoofed identity during the OAuth/SSO login flow, letting a remote attacker bypass authentication and obtain a fully privileged WordPress session on any site that deploys the plugin's SSO login feature. The flaw is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is remote and unauthenticated with no user interaction required, and successful abuse yields high confidentiality, integrity and availability impact across the site. At time of analysis there is no public exploit identified and the issue is not listed as confirmed actively exploited (CISA KEV); no EPSS score was supplied, but the critical severity and unauthenticated nature warrant urgent prioritisation for sites that have the plugin active and the SSO login endpoint reachable.
RemediationAI
The available intelligence does not specify an exact fixed release version, so no vendor-released patch version can be cited here; the first action is to consult the Patchstack record (https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-1-2-bypass-vulnerability-vulnerability?_s_id=cve) and the miniOrange plugin page for an updated build newer than 7.1.2, then upgrade once a fixed version is confirmed available, verifying the resulting version in the WordPress plugin list afterwards. If no updated build is available yet, the most effective compensating control is to deactivate the 'OAuth Single Sign On - SSO (OAuth Client)' plugin entirely until a fix ships; the trade-off is that all users currently authenticating through that SSO provider will lose federated login and must fall back to native WordPress credentials, which should be pre-provisioned to avoid lockout. If the plugin must stay active, disable the OAuth/SSO login path it exposes (and remove or unlink any widget, shortcode or public login link that routes users into it) so the vulnerable endpoint is no longer reachable, accepting that SSO login will be unavailable for the duration. Because the vector is PR:N with an unauthenticated, remotely reachable exploit path, additionally restrict or filter access to the affected login endpoints at the reverse proxy or WAF (blocking requests that initiate or complete the third-party OAuth flow from untrusted sources), understanding that legitimate SSO callbacks may be affected and will need allowlisting; audit WordPress user accounts and authentication logs, force password resets for privileged accounts, and review recent logins for evidence of anomalous sessions created through the SSO flow. Patch availability status should be re-checked regularly, since absence of a documented fix version in the current data is not confirmation that none exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-290 (Authentication Bypass by Spoofing): the plugin's OAuth client component does not adequately bind and validate the identity asserted in the SSO response it consumes, so an attacker can present a forged or spoofed assertion and be treated as an authenticated user. OAuth/OIDC SSO integrations rely on careful validation of redirect URIs, state/nonce parameters, token signatures and issuer/audience claims; failures in this validation chain convert what should be a trusted identity assertion into an attacker-controlled login. The CPE string cpe:2.3:a:miniorange:oauth_single_sign_on_-_sso_(oauth_client):*:*:*:*:*:*:* identifies the affected component as the miniOrange OAuth client plugin for WordPress (distributed under the slug miniorange-login-with-eve-online-google-facebook), which is a specialised rather than universal WordPress component - this deployment requirement, not any additional configuration complexity, is the principal narrowing condition. Per the assessed vector AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction and no non-default configuration beyond an active, reachable SSO login flow are prerequisites, and a successful bypass grants high CIA impact, consistent with taking over privileged accounts on the affected site.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote authentication bypass over the network with no user interaction; account takeover grants full confidentiality, integrity, and availability impact on the affected WordPress site.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Bypass Vulnerability in OAuth Single Sign On - SSO (OAuth Client) <= 7.1.2 versions.
Executive ViewAI
The miniOrange OAuth Single Sign On plugin for WordPress, versions 7.1.2 and earlier, permits unauthenticated attackers to bypass authentication and obtain fully privileged WordPress sessions on affected sites. This critical vulnerability affects any organization that deploys the plugin's SSO login feature, potentially exposing sensitive data, enabling site defacement, or disrupting operations. No vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, but the unauthenticated nature warrants immediate prioritization for exposed instances.
No vendor-released patch identified at time of analysis. Interim mitigations include: disabling the miniOrange OAuth Single Sign On plugin or its SSO login feature; restricting access to the SSO endpoint to trusted IP addresses; deploying WAF rules to detect and block spoofed identity attempts; enabling detailed authentication logging and monitoring; and enforcing additional authentication factors or network segmentation if the plugin must remain active. Monitor vendor for patch release and apply promptly.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB