Executive Summary

A critical vulnerability, CVE-2026-28008, with a CVSS score of 9.8, was discovered in the OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress. This vulnerability affects versions up to and including 7.0.0 and allows unauthenticated attackers to bypass authentication, potentially leading to unauthorized access and control.

Technical Analysis

This vulnerability is classified as CWE-290, Unauthenticated Broken Authentication. The vulnerability exists in the OAuth Single Sign On – SSO (OAuth Client) plugin, specifically in versions up to and including 7.0.0. The attack vector is network-based (AV:N), with low attack complexity (AC:L), and does not require any privileges (PR:N) or user interaction (UI:N). The vulnerability has a high impact on confidentiality (C:H), integrity (I:H), and availability (A:H). The root cause of this vulnerability is the lack of proper authentication mechanisms in the plugin.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the affected plugin. The attacker would not need any specific privileges or perform any user interaction. Upon successful exploitation, the attacker could bypass authentication and potentially gain unauthorized access to the affected system, allowing for high impact on confidentiality, integrity, and availability.

Impact Assessment

The OAuth Single Sign On – SSO (OAuth Client) plugin, version up to and including 7.0.0, is affected. Users of this plugin are at risk of unauthorized access and control. The CVSS score of 9.8 indicates a critical severity level. The vulnerability's exploitation could lead to a complete compromise of the affected system.

Recommended Actions

To mitigate this vulnerability, it is recommended to update the OAuth Single Sign On – SSO (OAuth Client) plugin to version 7.0.1 or later. Additionally, users should ensure that their plugin versions are up-to-date and monitor for any suspicious activity. Implementing a Web Application Firewall (WAF) rule to detect and block suspicious authentication requests may also be beneficial.

Sources