A critical authentication vulnerability in the OAuth Single Sign On WordPress plugin allows unauthenticated attackers to hijack user sessions and create unauthorized accounts.

The vulnerability is an improper authentication flaw (CWE-287) residing in the Steam single sign-on integration, which fails to validate identity assertions, thereby permitting unauthenticated access.

Successful exploitation of this flaw poses a severe risk to organizational security, as it allows unauthorized actors to gain access to the platform without valid credentials. Given the CVSS score of 8.1, this vulnerability could lead to widespread account compromise, unauthorized data access, and potential escalation of privileges if attackers create accounts with elevated roles or leverage hijacked sessions to manipulate sensitive information.

Immediate Action: Update the OAuth Single Sign On WordPress plugin to version 7.0.1 or later to implement proper identity assertion verification.

Proactive Monitoring: Review application logs for anomalous sign-in activity or unexpected account creation events that correlate with the Steam authentication flow.

Compensating Controls: If immediate patching is not feasible, disable the Steam single sign-on feature to prevent exploitation of the insecure assertion process.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

This vulnerability represents a significant security oversight in the authentication logic of the affected plugin. Administrators should prioritize updating the plugin to version 7.0.1 immediately to close the authentication gap and prevent unauthorized access. Failure to address this flaw could lead to systematic account takeover and compromise of the WordPress environment.