The OAuth Single Sign On – SSO plugin for WordPress is vulnerable to improper verification of cryptographic signature, allowing unauthenticated attackers to forge JSON Web Tokens. The plugin's get_resource_owner_from_id_token() function processes ID tokens without verifying the signature, which bypasses authentication. Attackers can trigger login with a fabricated token and gain access to any existing user account, including administrators, or create new subscriber-level accounts.

This issue affects the OAuth Single Sign On – SSO (OAuth Client) plugin from cyberlord92 distributed through WordPress, versions up to and including 6.26.12. Users running these versions of the plugin on any WordPress installation are susceptible.

The CVSS score of 9.8 indicates critical severity, though the EPSS score of less than 1% suggests a low probability of exploitation in the wild at present. The vulnerability is not yet listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can exploit this flaw remotely by crafting a malicious ID token within the OAuth authentication flow, thereby bypassing authentication without needing any credentials. This provides full account takeover for existing users or creation of new accounts.