The WP OAuth Server (Login with WordPress) plugin prior to version 6.4.0 contains an authentication bypass flaw. During the OpenID Connect flow the plugin fails to tie the issued identity assertion to the authorization grant exchange, instead returning the assertion of the most recently authenticated user. Because the assertion is cryptographically signed, any user with at least Subscriber privilege can acquire a valid assertion for another user, including administrators, and use it to authenticate to any application that trusts the site for single sign-on.

All WordPress sites that have the WP OAuth Server plugin installed with a version earlier than 6.4.0 are affected. The flaw impacts all users who have the Subscriber role or higher, regardless of the target application. No specific hardware or OS requirements are necessary beyond a functioning WordPress installation supporting OIDC.

The flaw has a CVSS score of 9, indicating critical severity. The EPSS score is currently unavailable, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers can exploit the issue by first authenticating as a subscriber or higher on the victim site, then issuing an OAuth authorization request that targets the identity assertion for a different user. Because the plugin returns the assertion of the last authenticated user, the attacker can obtain a signed token for a target account and use it to log in as that account. The attack requires no knowledge of the target account’s credentials and can be performed remotely through any OIDC‑enabled application integrated with the plugin. The lack of EPSS data makes the exact likelihood uncertain, but the high severity and wide reach of the flaw suggest it is a significant risk for exposed SSO deployments.