CVE-2024-10111 Overview
CVE-2024-10111 is an authentication bypass vulnerability in the OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress, also known as miniorange-login-with-eve-online-google-facebook. The flaw affects all versions up to and including 6.26.3. The plugin performs insufficient verification on the user identity returned by the social login token. Unauthenticated attackers can log in as any existing user, including administrators, provided they know the target username and the targeted user has not previously linked an account to the social provider returning the token. The issue is classified under CWE-287: Improper Authentication.
Critical Impact
Unauthenticated attackers can impersonate any WordPress user, including administrators, leading to full site compromise.
Affected Products
- WordPress plugin: OAuth Single Sign On – SSO (OAuth Client) by miniOrange
- Plugin slug: miniorange-login-with-eve-online-google-facebook
- All versions <= 6.26.3
Discovery Timeline
- 2024-12-12 - CVE-2024-10111 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10111
Vulnerability Analysis
The vulnerability resides in the social login flow handled by the OAuth client plugin. When a third-party identity provider returns an OAuth token, the plugin extracts user information such as the username or email and matches it against existing WordPress accounts. The plugin does not adequately validate that the returned identity is bound to the local account it resolves to. An attacker can craft or supply a token referencing a target WordPress username from a social provider where the legitimate user has never established a linked account, and the plugin will authenticate the session as that local user.
With an EPSS probability of 0.744%, the issue carries non-trivial exploitation interest given the prevalence of WordPress installations using social login plugins.
Root Cause
The root cause is missing identity binding verification. The plugin trusts attacker-controllable identity attributes returned from the social login callback to resolve a local WordPress account. It does not require that the targeted local account already possess a confirmed link to the social provider account asserted in the token. This trust gap converts a username into a sufficient credential for authentication.
Attack Vector
Exploitation occurs over the network with no privileges and no user interaction. An attacker enumerates or discovers a valid WordPress username, such as the site administrator. The attacker then initiates the plugin's social login flow with a provider where the target user has not registered a linked identity. The callback returns a token containing attacker-controlled identity attributes mapping to the victim username. The plugin issues an authenticated session for the victim account. See the Wordfence Vulnerability Report for additional technical context.
No public proof-of-concept code is provided in the references. The fix is documented in the WordPress Plugin Changeset.
Detection Methods for CVE-2024-10111
Indicators of Compromise
- Successful WordPress administrator logins via the OAuth/SSO callback endpoint from unfamiliar IP addresses or geolocations.
- New administrator-level sessions immediately followed by plugin installations, theme edits, or user role changes.
- OAuth callback requests referencing the miniorange-login-with-eve-online-google-facebook plugin endpoint with anomalous state or code parameters.
- Wordfence or other WAF telemetry flagging authentication anomalies tied to social login handlers.
Detection Strategies
- Review WordPress authentication logs for sessions established through the social login flow against accounts that have no record of linking a social provider.
- Compare wp_usermeta linkage records to actual login events to identify mismatches between authenticated identity and bound provider IDs.
- Inspect web server access logs for requests to the plugin's OAuth callback URL paired with privileged post-login activity.
Monitoring Recommendations
- Forward WordPress authentication and admin action logs to a centralized SIEM for behavioral correlation.
- Alert on first-time successful logins to administrator accounts originating from the social login callback.
- Track plugin file integrity for miniorange-login-with-eve-online-google-facebook to confirm patched versions remain in place.
How to Mitigate CVE-2024-10111
Immediate Actions Required
- Update the OAuth Single Sign On – SSO (OAuth Client) plugin to a version above 6.26.3 immediately.
- Audit all WordPress administrator and editor accounts for unexpected logins or configuration changes since the plugin was installed.
- Force a password reset and invalidate active sessions for all privileged accounts after patching.
- Enable multi-factor authentication on all administrator accounts to add a verification layer independent of the OAuth flow.
Patch Information
The plugin vendor released a fix referenced in the WordPress Plugin Changeset. Administrators should install the latest version from the WordPress Plugin Overview page or via the WordPress admin dashboard plugin updater.
Workarounds
- Deactivate and remove the OAuth Single Sign On – SSO (OAuth Client) plugin until the patched version is deployed.
- Restrict access to /wp-login.php and the plugin's OAuth callback endpoint to known IP ranges using a WAF or web server access controls.
- Require all administrators to authenticate exclusively through native WordPress login with MFA while the plugin is disabled.
# Configuration example: disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate miniorange-login-with-eve-online-google-facebook
wp plugin update miniorange-login-with-eve-online-google-facebook
wp plugin status miniorange-login-with-eve-online-google-facebook
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
