The WP OAuth Server plugin contains a critical authentication flaw that allows authenticated users to hijack administrator sessions via identity assertion spoofing.

This vulnerability is an improper authentication issue (CWE-287) where the plugin fails to bind identity assertions to the correct authorization grant. This allows any authenticated user, such as a Subscriber, to obtain a validly signed identity assertion for another user and authenticate as them across integrated single sign-on applications.

The ability for a low-privileged user to impersonate an administrator presents a severe risk to organizational security. Successful exploitation could lead to full unauthorized access to the WordPress environment and any external systems relying on the plugin for authentication, resulting in total data compromise and administrative takeover. Given the CVSS score of 9.0, this vulnerability constitutes a critical threat to the integrity and availability of integrated identity services.

Immediate Action: Update the WP OAuth Server (Login with WordPress) plugin to version 6.4.0 or later immediately to resolve the identity binding flaw.

Proactive Monitoring: Review access logs for suspicious authentication patterns, particularly multiple successful logins from a single user account originating from disparate source IP addresses.

Compensating Controls: If immediate patching is not possible, disable the OpenID Connect functionality within the plugin to prevent unauthorized identity assertion generation until the update can be applied.

Public Exploit Available: No

This vulnerability represents a critical risk to the security of your identity management infrastructure. Because it allows for complete account takeover through identity assertion spoofing, administrators must prioritize the update to version 6.4.0. Failure to remediate this issue exposes the entire SSO ecosystem to unauthorized access and potential administrative compromise.