The vulnerability is an incorrect privilege assignment flaw in the miniOrange OAuth Single Sign On – SSO (OAuth Client) WordPress plugin that permits an authenticated attacker to elevate privileges. An attacker could gain administrator or super‑admin rights, compromising confidentiality, integrity, and availability.

All installations of the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin from the initial release up to version 7.1.3 are affected. Sites using the plugin without updating to 7.1.4 or newer are at risk.

The CVSS score of 9.8 indicates critical severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through the plugin’s OAuth flow where an attacker can manipulate role assignments during authentication, requiring at least an authenticated session but the exact prerequisites are not fully detailed.