Critical WordPress OAuth SSO Plugin Flaw (CVSS 9.8) Risks Full Site Takeover

A critical authentication bypass vulnerability has been discovered in the OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress, developed by miniOrange.

Tracked as CVE-2026-57807, the flaw carries a maximum-severity CVSS score of 9.8 and affects all versions up to and including 38.5.8. With no official patch currently available, security researchers are urging site administrators to take immediate protective action.

The vulnerability falls under OWASP A7: Identification and Authentication Failures, classified specifically as a Broken Authentication issue.

Critical WordPress OAuth SSO Plugin Flaw

According to Patchstack, the flaw could allow an unauthenticated attacker to perform actions that should be restricted to higher-privileged users, potentially including gaining full administrator access to an affected WordPress site.

Because the plugin handles OAuth and OpenID Connect (OIDC) based single sign-on, it sits at a particularly sensitive layer of a website’s identity infrastructure.

A breach of that trust boundary doesn’t just expose a single feature; it can effectively hand over the keys to the entire site, since SSO plugins are often deeply integrated with login and session management.

Patchstack has flagged this issue as highly likely to be mass-exploited, noting that vulnerabilities of this nature are typically weaponized in automated, large-scale attack campaigns. These campaigns don’t discriminate based on site traffic or popularity any vulnerable installation is a potential target.

The 9.8 CVSS score places it in the “critical” tier for several converging reasons:

No authentication is required to exploit it
Impact includes potential admin-level compromise
The plugin is widely used for enterprise SSO integrations
No official fix exists yet at time of disclosure”Authentication plugins are the crown jewels of a WordPress site’s security posture. When an SSO mechanism itself becomes the attack vector, it inverts the very trust model organizations rely on, turning a login gateway into an open door,” said one independent security researcher tracking the disclosure.

The vulnerability was responsibly reported by researcher Kim Dvash on June 6, 2026, and publicly disclosed by Patchstack on July 9, 2026. As of this writing, the miniOrange plugin does not have a designated Vulnerability Disclosure Program (VDP), which may have contributed to the delay in an official fix reaching users.

Mitigation

Since no patched version currently exists, WordPress administrators using this plugin should consider the following immediate steps:

Check installed plugin version and compare against the vulnerable range (≤ 38.5.8)
Monitor official miniOrange channels for a security update
Deploy a virtual patch or WAF rule if using a security service like Patchstack
Temporarily disable the plugin if SSO functionality isn’t business-critical
Audit recent admin account activity for signs of compromise

Patchstack has already issued a mitigation rule designed to block exploitation attempts until an official patch is released, tested, and confirmed safe for deployment. Given the “unauthenticated” attack vector and near-maximum severity score, this is not a vulnerability to leave unaddressed even temporarily.

Site owners relying on this plugin for enterprise login flows should treat this disclosure as a priority incident rather than a routine plugin update reminder.