Introduction
Attackers can forge authentication tokens to gain administrator access to WordPress sites running a popular OAuth plugin. The flaw affects thousands of sites that use the OAuth Single Sign On – SSO (OAuth Client) plugin to handle secure login through enterprise identity providers.
The OAuth Single Sign On – SSO (OAuth Client) plugin is developed by miniOrange, a major vendor of WordPress authentication plugins. It supports OAuth 1.0, 2.0, 2.1, and OpenID Connect, and organizations use it to connect WordPress with providers like Azure AD, Google Workspace, and Office 365. It is widely used in enterprise and SMB environments.
Technical Information
CVE-2025-9485 comes from improper verification of JWT signatures in the get_resource_owner_from_id_token function. In all versions up to and including 6.26.12, the plugin processes JWT tokens from OAuth or OpenID Connect providers without validating their cryptographic signatures. Anyone can submit a JWT with a forged payload and an invalid or empty signature, and the plugin will accept it as authentic.
The vulnerable code is in class-mooauth-widget.php at line 577 in version 6.26.12:
// Reference: https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L577 // The function get_resource_owner_from_id_token processes the JWT without signature verification
Because the plugin never checks the signature, an attacker can craft a JWT with the sub claim set to any user ID, including an administrator's, and submit it. The plugin then logs the attacker in as that user. In some configurations, attackers can also create arbitrary subscriber-level accounts by manipulating the token payload.
The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature).
Affected Systems and Versions
- Product: OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress (by miniOrange)
- Affected versions: Up to and including 6.26.12
- All configurations using the plugin's OAuth or OpenID Connect login flows are vulnerable
Vendor Security History
miniOrange has previously released WordPress plugins with advanced authentication features. Recent disclosures found the same plugin vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 6.26.12. The vendor responded rapidly to the JWT flaw and released a patched version (6.26.13) soon after disclosure. Still, a core authentication plugin with both a CSRF bug and a JWT signature verification bypass points to a need for stronger security review and testing in miniOrange's development process.
