CVE-2026-97274

CriticalCVSS 9.8

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The OAuth Single Sign On – SSO (OAuth Client) plugin in versions up to and including 7.1.2 contains an unauthenticated bypass vulnerability. An attacker does not need prior authentication to exploit this flaw.

Risk Assessment

An attacker could gain access to protected resources without valid credentials, potentially leading to account takeover or unauthorized system access.

Recommendation

Update the OAuth Single Sign On – SSO (OAuth Client) plugin to a version newer than 7.1.2 that fixes this vulnerability.

Other vulnerabilities in OAuth Single Sign On – SSO (OAuth Client)

CVE-2026-57807Critical
The OAuth Single Sign On - SSO (OAuth Client) plugin for WordPress contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation. This issue affects versions up to and including 38.5.8.

Original NVD description (English source)

Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS