Unauthenticated bypass vulnerability in the WordPress OAuth Single Sign On – SSO (OAuth Client) plugin allows an attacker to gain access to the website without providing valid credentials. The flaw enables unintended authentication, potentially exposing protected content and administrative functions to any visitor. The weakness is the improper restriction of authentication checks, classified as CWE-290.

The vulnerability affects the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress, versions 7.1.2 and earlier. Any WordPress site that has one of those versions installed is vulnerable.

The CVSS score of 9.8 indicates high severity, and the vulnerability is exploitable by unauthenticated users over the network. EPSS is not available, and the issue is not listed in the CISA KEV catalog, but the lack of a patch means a determined attacker can deploy the bypass immediately. The likely attack vector is through the plugin’s OAuth endpoints; attackers can craft requests that trigger the authorization flow without proper credential verification.