CVE-2026-7617: Secufor_OAuth WordPress Auth Bypass Flaw

CVE-2026-7617 Overview

CVE-2026-7617 is a missing authorization vulnerability [CWE-862] affecting the Secufor_OAuth plugin for WordPress in all versions up to and including 1.0.7. The plugin fails to verify that a user is authorized to perform certain actions. Unauthenticated attackers can exploit this flaw remotely over the network to disconnect a WordPress site from its linked Secufor account. The attack clears the plugin's stored login token and user login configuration, breaking the OAuth integration without requiring credentials or user interaction.

Critical Impact
Unauthenticated remote attackers can disrupt the Secufor OAuth integration on affected WordPress sites by clearing stored authentication tokens, resulting in loss of single sign-on (SSO) functionality for site users.

Affected Products

Secufor_OAuth plugin for WordPress — all versions through 1.0.7
WordPress installations with the wpoauth plugin enabled
Sites relying on Secufor for OAuth-based authentication

Discovery Timeline

2026-06-24 - CVE-2026-7617 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-7617

Vulnerability Analysis

The vulnerability resides in the secuforoauth_login.php file of the Secufor_OAuth WordPress plugin. The affected code paths at lines 212 and 220 implement actions that modify plugin state without performing capability checks or nonce validation. As a result, anyone able to reach the action endpoint can invoke privileged functionality reserved for administrators.

The specific action exposed by the flaw allows clearing the plugin's stored OAuth login token and resetting the user login configuration. Once these values are cleared, the WordPress site is disconnected from its linked Secufor account. Users who depended on the Secufor OAuth flow for authentication lose the ability to sign in through that path until an administrator reconnects the integration.

The issue is categorized as a Missing Authorization weakness because the plugin treats the request as legitimate based purely on its arrival, without confirming the caller's identity or privilege level.

Root Cause

The root cause is the absence of authorization checks on a state-changing handler in secuforoauth_login.php. The plugin neither calls current_user_can() to validate administrator capability nor verifies a WordPress nonce to confirm request intent. Without these gating mechanisms, the disconnect action is reachable by any unauthenticated visitor.

Attack Vector

An attacker sends a crafted HTTP request to the vulnerable WordPress endpoint exposed by the plugin. No authentication, user interaction, or elevated privileges are required. The request triggers the unprotected handler, which clears the OAuth login token and the linked user login configuration stored by the plugin. The impact is limited to integrity loss of the Secufor integration configuration; confidentiality and availability of the broader WordPress site are not directly affected.

No public proof-of-concept exploit is currently listed in Exploit-DB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the WordPress Plugin Code Review at line 212, the WordPress Plugin Code Review at line 220, and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-7617

Indicators of Compromise

Unexpected clearing of Secufor OAuth tokens or user login configuration in the WordPress wp_options table.
Sudden loss of Secufor SSO functionality without an administrator-initiated change.
HTTP requests targeting Secufor_OAuth plugin endpoints in secuforoauth_login.php from unauthenticated sources.

Detection Strategies

Review web server access logs for requests to the wpoauth plugin handler paths from clients lacking valid administrator sessions.
Monitor the wp_options table for unexpected modifications to Secufor-related option keys.
Audit WordPress activity logs for OAuth disconnection events that do not correlate with administrator activity.

Monitoring Recommendations

Enable a WordPress audit logging plugin to record plugin configuration changes with timestamp and source IP.
Alert on repeated requests to plugin endpoints from IPs without authenticated sessions.
Forward web access logs to a centralized SIEM or data lake to correlate unauthenticated state changes against plugin paths.

How to Mitigate CVE-2026-7617

Immediate Actions Required

Update the Secufor_OAuth plugin to a version later than 1.0.7 once the vendor releases a patched release.
If no fixed version is yet available, deactivate and remove the Secufor_OAuth plugin until a patch is published.
Reconnect the WordPress site to the Secufor account after remediation to restore OAuth functionality.

Patch Information

At the time of publication, the vulnerability affects all versions up to and including 1.0.7. Administrators should consult the Wordfence Vulnerability Report for the latest fix status and upgrade to the first version that addresses the missing authorization check.

Workarounds

Restrict access to WordPress admin-ajax and plugin endpoints using a Web Application Firewall (WAF) rule that blocks unauthenticated POST requests to secuforoauth_login.php handlers.
Limit access to the WordPress site to known IP ranges where feasible until a patched version is installed.
Disable the Secufor_OAuth plugin if SSO via Secufor is not actively required.

bash

# Example WAF rule (ModSecurity) to block unauthenticated access to the vulnerable handler
SecRule REQUEST_URI "@contains secuforoauth_login.php" \
    "id:1026007617,\
    phase:1,\
    deny,\
    status:403,\
    msg:'Block unauthenticated access to Secufor_OAuth handler (CVE-2026-7617)',\
    chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"