Technical impact
The Secufor_OAuth plugin for WordPress suffers from a missing authorization check that allows an attacker who is not authenticated to invoke the AJAX action 'secuforoauth_unregister_action'. By doing so, the attacker can clear the stored login token and user login configuration for the WordPress site, effectively severing the connection with the linked Secufor account. This flaw enables an unauthenticated user to disrupt the authentication workflow without compromising other aspects of site integrity, leading to service degradation or temporary loss of OAuth capabilities.
Affected Systems
WordPress sites installing the Secufor_OAuth plugin, specifically all versions up to and including 1.0.7. Any site using these versions is susceptible to the unauthorized logout vulnerability.
Risk and Exploitability
The vulnerability has a CVSS score of 5.3, indicating moderate severity. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild. Attackers can target the site via a GET or POST request to the underlying AJAX endpoint without authentication, so the vector is remote and unauthenticated. The potential impact is primarily service interruption, as the OAuth link is severed but does not grant further access.
