CVE-2025-10752
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request, granted they can trick a site administrator into performing an action such as clicking on a link.
Risk Assessment
An attacker can hijack the OAuth flow and gain unauthorized access to user accounts, potentially leading to data breach or account takeover.
Recommendation
Update the OAuth Single Sign On plugin to a version newer than 6.26.12, which includes a fix for this vulnerability.
Other vulnerabilities in OAuth Single Sign On – SSO (OAuth Client)
See all- CVE-2026-97274Critical
The OAuth Single Sign On – SSO (OAuth Client) plugin in versions up to and including 7.1.2 contains an unauthenticated bypass vulnerability. An attacker does not need prior authentication to exploit this flaw.
- CVE-2026-57807Critical
The OAuth Single Sign On - SSO (OAuth Client) plugin for WordPress contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation. This issue affects versions up to and including 38.5.8.
Original NVD description (English source)
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS