CVE-2026-82843: WP OAuth Server Auth Bypass Vulnerability

CVE-2026-82843 Overview

CVE-2026-82843 affects the WP OAuth Server (Login with WordPress) plugin in versions prior to 6.4.0. The plugin fails to bind the OpenID Connect (OIDC) identity assertion to the authorization grant being exchanged. Instead, it returns the assertion belonging to whichever user authenticated most recently on the site. Authenticated users with the Subscriber role or higher can obtain a validly signed identity assertion for another user, including an administrator. Attackers can then authenticate as that user at any downstream application using the site for single sign-on (SSO). The weakness maps to [CWE-287: Improper Authentication].

Critical Impact
A low-privileged WordPress subscriber can hijack any account, including administrators, on downstream applications relying on the vulnerable site for SSO.

Affected Products

WP OAuth Server (Login with WordPress) WordPress plugin versions before 6.4.0
WordPress sites using the plugin as an OpenID Connect identity provider
Downstream applications that federate authentication through the vulnerable plugin

Discovery Timeline

2026-09-23 - CVE-2026-82843 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-82843

Vulnerability Analysis

The flaw resides in how the plugin issues OpenID Connect identity assertions during the authorization code exchange. In a correct OIDC implementation, the identity token returned at the token endpoint must be bound to the specific authorization grant issued to a specific authenticated user. The WP OAuth Server plugin instead returns the identity assertion for whichever user authenticated most recently in the WordPress session context. This decoupling breaks the trust model of federated authentication. Any downstream service accepting the signed assertion will treat the requester as the impersonated user.

Root Cause

The plugin does not associate the OIDC identity assertion with the authorization code being redeemed. Session state and grant state are handled independently, so the token endpoint reads the current session identity rather than the identity captured when the authorization grant was issued. This is a classic broken authentication pattern where session context substitutes for cryptographically bound grant context.

Attack Vector

An attacker holding at least Subscriber credentials initiates an OAuth authorization flow against the vulnerable site. The attacker waits for or induces an administrator to authenticate on the same WordPress instance. The attacker then completes the token exchange. The token endpoint returns a signed identity assertion tied to the administrator rather than to the attacker's grant. The attacker presents this assertion to any SSO-connected application and gains administrator-level access there.

No synthetic proof-of-concept is published. Refer to the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-82843

Indicators of Compromise

Token endpoint responses where the sub claim in the returned ID token does not match the WordPress user that initiated the authorization request.
Successful SSO logins to downstream applications from user accounts that never completed an interactive authorization step.
Bursts of authorization code redemptions from low-privileged accounts followed by administrator sessions on federated applications.

Detection Strategies

Correlate WordPress authentication logs with OAuth authorization and token endpoint logs to identify mismatches between the grant owner and the returned identity subject.
Review downstream SSO application logs for privileged sessions that originate from IP addresses previously associated with subscriber-level accounts.
Alert on any OIDC token exchange where the authenticated session user differs from the user recorded when the authorization code was issued.

Monitoring Recommendations

Enable verbose logging on the WP OAuth Server plugin and forward logs to a centralized SIEM for correlation with WordPress and downstream application telemetry.
Monitor administrator role assumption events on federated applications and alert when the identity source is the vulnerable plugin.
Track plugin version inventory across WordPress deployments to flag any instance still running a release prior to 6.4.0.

How to Mitigate CVE-2026-82843

Immediate Actions Required

Upgrade the WP OAuth Server (Login with WordPress) plugin to version 6.4.0 or later on every affected WordPress site.
Rotate signing keys used by the plugin so any previously issued identity assertions cannot be replayed against downstream services.
Audit administrator activity on all SSO-connected applications for the period the vulnerable plugin was in production.
Force reauthentication and session invalidation for all users across federated applications.

Patch Information

The vendor addressed the issue in WP OAuth Server version 6.4.0. Consult the WPScan Vulnerability Report for the vendor's patch reference and remediation notes.

Workarounds

Disable the WP OAuth Server plugin until the upgrade to 6.4.0 or later can be completed.
Restrict WordPress account creation and reduce the number of accounts holding Subscriber role or above while the plugin is unpatched.
Temporarily remove the vulnerable site as a trusted identity provider from downstream applications that rely on it for SSO.

bash

# Configuration example
wp plugin update wp-oauth-server --version=6.4.0
wp user list --role=subscriber --field=ID | xargs -I {} wp user session destroy {} --all