CVE-2025-10753: WordPress OAuth SSO Auth Bypass Flaw

CVE-2025-10753 Overview

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress contains an authorization bypass vulnerability that allows unauthenticated attackers to modify critical redirect URL settings. This vulnerability exists due to missing capability checks and authentication verification on the OAuth redirect functionality, which can be accessed via the oauthredirect option parameter.

Critical Impact

Unauthenticated attackers can manipulate the global redirect URL option, potentially enabling phishing attacks, credential theft, or user session hijacking through malicious redirect destinations.

Affected Products

• OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress versions up to and including 6.26.14
• miniOrange Login with Eve Online, Google, Facebook plugin (affected component)

Discovery Timeline

• 2026-02-06 - CVE-2025-10753 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2025-10753

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), representing a critical gap in access control implementation within the WordPress plugin's OAuth redirect handling mechanism. The flaw allows unauthenticated users to invoke functionality that should be restricted to authenticated administrators.

The vulnerable functionality resides in the class-mooauth-widget.php file, specifically around the OAuth redirect handling logic. When the oauthredirect option parameter is passed in a request, the plugin fails to verify whether the requesting user has appropriate capabilities or is even authenticated before processing the redirect URL modification.

This architectural weakness means any external actor who can reach the WordPress site directly can manipulate where OAuth authentication flows redirect users after completion—a particularly dangerous scenario in single sign-on implementations where redirect URLs determine post-authentication destinations.

Root Cause

The root cause of this vulnerability is the absence of proper authorization checks in the OAuth redirect functionality. The plugin processes the oauthredirect parameter and allows modification of the redirect_url setting without:

1. Verifying the user is authenticated to WordPress
2. Checking that the user has administrator-level capabilities
3. Validating a nonce or other CSRF protection token

This represents a fundamental security design flaw where sensitive configuration changes are exposed to unauthenticated requests.

Attack Vector

The vulnerability is exploitable over the network without requiring any authentication or user interaction. An attacker can craft a malicious HTTP request targeting the WordPress site's OAuth handling endpoint with the oauthredirect option parameter and a custom redirect_url value.

Once the global redirect URL is modified, legitimate users completing OAuth authentication flows may be redirected to attacker-controlled domains. This enables various attack scenarios including credential phishing, session token capture, or delivery of malicious payloads disguised as authentication completion pages.

The attack requires direct access to the affected WordPress site but does not require any privileges, making it straightforward to exploit at scale against vulnerable installations.

Detection Methods for CVE-2025-10753

Indicators of Compromise

• Unexpected modifications to OAuth redirect URL settings in WordPress database (wp_options table)
• HTTP requests containing the oauthredirect parameter from unauthenticated sources
• Users reporting unexpected redirects after OAuth authentication attempts
• Log entries showing requests with suspicious redirect_url parameter values pointing to external domains

Detection Strategies

• Monitor HTTP access logs for requests containing oauthredirect parameter, especially from unauthenticated sessions
• Implement Web Application Firewall (WAF) rules to alert on parameter manipulation attempts targeting OAuth endpoints
• Set up database monitoring for changes to miniOrange OAuth plugin configuration options
• Review WordPress audit logs for unexpected setting modifications without corresponding admin authentication

Monitoring Recommendations

• Enable detailed logging for the OAuth Single Sign On plugin and related authentication activities
• Configure alerts for any changes to OAuth redirect URL settings outside of administrative sessions
• Implement real-time monitoring for suspicious request patterns targeting WordPress plugin endpoints
• Establish baseline redirect URL configurations and alert on deviations

How to Mitigate CVE-2025-10753

Immediate Actions Required

• Update the OAuth Single Sign On – SSO (OAuth Client) plugin to the latest patched version immediately
• Review current redirect URL settings in the plugin configuration to ensure they have not been tampered with
• Audit access logs for signs of exploitation attempts or successful attacks
• Consider temporarily disabling the OAuth functionality if unable to patch immediately

Patch Information

The vulnerability affects all versions of the OAuth Single Sign On – SSO (OAuth Client) plugin up to and including version 6.26.14. Security updates addressing this vulnerability have been released through the official WordPress plugin repository.

The fix implements proper capability checks and authentication verification before allowing modification of OAuth redirect settings. Details of the code changes can be found in the WordPress Plugin Changeset Update.

For additional vulnerability details, refer to the Wordfence Vulnerability Report and the WordPress Plugin Code Review.

Workarounds

• Implement WAF rules to block requests containing the oauthredirect parameter from unauthenticated users
• Restrict access to WordPress admin and OAuth endpoints at the network level using IP allowlisting
• Temporarily disable the OAuth Single Sign On plugin if it is not critical to operations until patching is complete
• Enable WordPress two-factor authentication for all administrator accounts to reduce risk exposure

# Example Apache .htaccess rule to block unauthenticated oauthredirect requests
# Add to WordPress root .htaccess file
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} oauthredirect [NC]
    RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
    RewriteRule .* - [F,L]
</IfModule>