The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress uses a predictable state parameter, based on a base64 encoded application name, without any randomness in the OAuth flow. This flaw allows an unauthenticated attacker to forge OAuth authorization requests and hijack the flow if a site administrator is tricked into clicking a crafted link. The result is potential unauthorized access to user accounts or impersonation of the administrator, qualifying as a CSRF weakness.

The vulnerability affects the OAuth Single Sign On – SSO (OAuth Client) plugin distributed by cyberlord92. All installations running version 6.26.12 or earlier are affected. No other WordPress plugins or system components are reported to be impacted.

The reported CVSS score of 4.3 places the issue in the low‑to‑moderate severity range, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a CSRF attack against an administrator who is persuaded to click a malicious link, and the attacker must predict the opaque state value. Because of these requirements, the risk to most organizations remains limited unless the plugin is the sole OAuth provider in use or administrators are highly susceptible to phishing.