Medium severity · published Feb 6, 2026
CVE-2025-10753
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is due to missing capability checks and authentication verification on the OAuth redirect functionality accessible via the 'oauthredirect' option parameter. This makes it possible for unauthenticated attackers to set the global redirect URL option via the redirect_url parameter granted they can access the site directly.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OS
OAuth Single Sign On – SSO (OAuth Client) · cyberlord92
through 6.26.14 · source: vendor
Affected product
OS
OAuth Single Sign On – SSO (OAuth Client)
cyberlord92
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10753
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L260
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399223%40miniorange-login-with-eve-online-google-facebook&new=3399223%40miniorange-login-with-eve-online-google-facebook&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/915e1a6e-ad9c-4849-8ae0-3ded18720a1f?source=cve
More from OAuth Single Sign On – SSO (OAuth Client)
9.8
CVE-2025-9485
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()
8.1
CVE-2024-10111
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass
4.3
CVE-2025-10752
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery