Identity CVE · OAuth / OIDC / JWT
CVE-2025-9485WordPress OAuth SSO plugin JWT bypass, admin takeover
critical
Product: OAuth SSO WordPress pluginVendor: miniOrange / WordPress ecosystemCWE-347Disclosed: 2025-08-26Status: PatchedProtocol deep diveNVD ↗
What broke
The OAuth SSO plugin for WordPress (through 6.26.12) did not verify JWT signatures correctly. An attacker could mint a token and become an administrator. Fixed in 6.26.13.
Why it matters
WordPress is not an IdP, but it is often the first SSO-enabled public site a company ships. A plugin that "adds OAuth" and then skips signature checks is how a marketing CMS becomes a privileged foothold. The same class as node-jws and SimpleHelp: the token is trusted because it looks like a token.
What to do
- Update the plugin to 6.26.13 or later. If you cannot, disable SSO on that site.
- Review WordPress administrator accounts created around the disclosure window.
- Do not point production OIDC at a plugin you have not seen verify signatures against a JWKS.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.