A critical authentication bypass vulnerability in the miniOrange OAuth Single Sign On plugin enables unauthenticated attackers to compromise user accounts via the password recovery flow.

This is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability. The flaw exists within the password recovery functionality, allowing an unauthenticated attacker to manipulate the authentication process to gain unauthorized access.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls entirely, leading to full unauthorized access to user accounts. With a CVSS score of 9.8, this represents a critical risk that could result in total compromise of sensitive user data, unauthorized administrative actions, and significant reputational damage.

Immediate Action: Update the miniOrange OAuth Single Sign On - SSO (OAuth Client) plugin to the latest available version immediately to patch the authentication logic.

Proactive Monitoring: Monitor server access logs for unusual patterns in password recovery requests or spikes in authentication failures originating from unexpected sources.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block suspicious traffic patterns targeting authentication or recovery endpoints.

Public Exploit Available: False

Given the critical CVSS severity of 9.8 and the ease of exploitation inherent in authentication bypass flaws, immediate patching is required. Administrators should prioritize this update across all affected WordPress environments to prevent potential account takeovers.