CVE-2025-10752 Overview
CVE-2025-10752 is a Cross-Site Request Forgery [CWE-352] vulnerability in the OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress. The flaw affects all plugin versions up to and including 6.26.12. The root cause is a predictable state parameter in the OAuth flow, generated as a base64-encoded application name without any random entropy. Unauthenticated attackers can forge OAuth authorization requests and potentially hijack the OAuth flow if a site administrator is tricked into clicking a crafted link. The vulnerability requires user interaction and results in a limited integrity impact.
Critical Impact
Attackers can hijack the OAuth authorization flow on affected WordPress sites by exploiting a non-random state parameter, enabling forged sign-on requests when an administrator interacts with a malicious link.
Affected Products
- OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress
- All plugin versions up to and including 6.26.12
- WordPress sites using the miniorange-login-with-eve-online-google-facebook plugin package
Discovery Timeline
- 2025-09-26 - CVE-2025-10752 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10752
Vulnerability Analysis
The OAuth 2.0 specification defines the state parameter as a security control against CSRF attacks during the authorization redirect. Clients are expected to generate an unpredictable value, bind it to the user session, and validate it upon callback. This binding prevents an attacker from injecting an authorization response into a victim's session.
The affected plugin violates this requirement. It constructs the state parameter by base64-encoding the application name, which is a static, guessable value. Because the parameter contains no randomness and is not tied to a per-session nonce, an attacker can predict or replay it. This eliminates the CSRF protection the parameter is intended to provide within the OAuth flow.
Root Cause
The vulnerable code path resides in class-mooauth-widget.php around line 285, where the state parameter is produced by base64-encoding the app name rather than a cryptographically random token. The absence of wp_create_nonce() or an equivalent random value allows attackers to precompute valid-looking authorization requests.
Attack Vector
An unauthenticated attacker crafts a malicious link or web page that initiates an OAuth authorization request with a known, predictable state value. If a site administrator visits the attacker-controlled resource while authenticated to the WordPress site, the forged request is submitted in the administrator's context. The attacker can hijack the OAuth callback flow, potentially linking accounts or forcing unintended authorization actions. Exploitation requires user interaction but no privileges on the target site.
For technical specifics, see the WordPress Plugin Code Reference and the Wordfence Vulnerability Analysis.
Detection Methods for CVE-2025-10752
Indicators of Compromise
- OAuth authorization requests to the plugin's endpoints containing a base64-encoded application name as the state parameter instead of a high-entropy value.
- Unexpected OAuth callback traffic in web server logs referencing mooauth handlers without a preceding administrator-initiated login attempt.
- Referer headers on OAuth callbacks originating from external, non-trusted domains.
Detection Strategies
- Inspect WordPress access logs for repeated OAuth authorization initiations tied to the same static state value.
- Compare installed plugin versions against 6.26.12 and flag any equal or lower.
- Alert on browser-delivered links to administrators containing OAuth authorization query strings targeting the WordPress site.
Monitoring Recommendations
- Forward WordPress and web server access logs to a centralized logging platform and build queries for OAuth callback anomalies.
- Monitor administrator user activity for unexpected OAuth account link or unlink events.
- Track plugin inventory changes and version drift across managed WordPress deployments.
How to Mitigate CVE-2025-10752
Immediate Actions Required
- Update the OAuth Single Sign On – SSO (OAuth Client) plugin to a version released after 6.26.12 that addresses the state parameter randomness issue.
- Audit administrator accounts for unexpected linked OAuth identities or recent authorization changes.
- Educate administrators to avoid clicking untrusted OAuth-related links, particularly while authenticated to WordPress admin sessions.
Patch Information
Review the vendor's plugin changelog for the fix. Details are available in the WordPress Plugin Change Log. The corrected implementation replaces the predictable base64-encoded app name with a cryptographically random state value bound to the user session.
Workarounds
- Temporarily deactivate the plugin on sites where an update cannot be applied immediately.
- Restrict administrator browsing to trusted sites and require separate browser profiles for WordPress administration.
- Deploy a Web Application Firewall (WAF) rule to block OAuth callback requests whose state parameter matches known predictable base64 strings.
# Configuration example: WAF rule concept to block predictable OAuth state values
# Adjust the regex to match the base64-encoded app name observed in vulnerable installs
SecRule ARGS:state "@rx ^[A-Za-z0-9+/=]{4,32}$" \
"id:1010752,phase:2,deny,log,status:403,\
msg:'CVE-2025-10752: Suspicious low-entropy OAuth state parameter'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
