CVE-2026-97274

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability

Published Sep 30, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Analysis

Technical impact

Unauthenticated bypass vulnerability in the WordPress OAuth Single Sign On – SSO (OAuth Client) plugin allows an attacker to gain access to the website without providing valid credentials. The flaw enables unintended authentication, potentially exposing protected content and administrative functions to any visitor. The weakness is the improper restriction of authentication checks, classified as CWE-290.

Affected Systems

The vulnerability affects the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress, versions 7.1.2 and earlier. Any WordPress site that has one of those versions installed is vulnerable.

Risk and Exploitability

The CVSS score of 9.8 indicates high severity, and the vulnerability is exploitable by unauthenticated users over the network. EPSS is not available, and the issue is not listed in the CISA KEV catalog, but the lack of a patch means a determined attacker can deploy the bypass immediately. The likely attack vector is through the plugin’s OAuth endpoints; attackers can craft requests that trigger the authorization flow without proper credential verification.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

miniOrange

OAuth Single Sign On – SSO (OAuth Client)

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 7.1.2

No data.

No data available yet.

Remediation

Vendor Solution

Update the WordPress OAuth Single Sign On – SSO (OAuth Client) plugin to the latest available version (at least 7.1.3).

OpenCVE Recommended Actions

Update the WordPress OAuth Single Sign On – SSO (OAuth Client) plugin to version 7.1.3 or later, which removes the unauthenticated bypass.
If the plugin is not required, uninstall or disable it from the WordPress site.
Configure the site’s firewall or access control lists to block unauthenticated requests to OAuth endpoints until the plugin patch is deployed.

Generated by OpenCVE AI on September 30, 2026 at 15:02 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.292% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-1-2-bypass-vulnerability-vulnerability?_s_id=cve

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 30, 2026 1:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
Title		WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerability
Weaknesses		CWE-290
References		https://patchstack.com/database/wordpress/plugin/miniorange-login-with-eve-online-google-facebook/vulnerability/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-7-1-2-bypass-vulnerability-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`