Description

Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) miniorange-login-with-eve-online-google-facebook allows Privilege Escalation.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 7.1.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T08:17:19.657Z",
  "pubdate": "2026-11-06T08:17:19.657Z",
  "executiveSummary": "The miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin is susceptible to an Incorrect Privilege Assignment vulnerability, which facilitates unauthorized privilege escalation. This security flaw resides within the authentication flow of the plugin and impacts all versions from n/a through 7.1.3.\nThe vulnerability allows an authenticated or unauthenticated attacker to manipulate the SSO process to gain elevated administrative privileges within the WordPress environment. By exploiting improper handling of user roles or identity mapping during the OAuth handshake, an attacker can bypass standard access control mechanisms.\nThe risk implication is critical, as it enables unauthorized users to achieve full administrative control over the affected site. The impact includes complete system compromise, data exfiltration, and the modification of security configurations. Successful exploitation requires the plugin to be active and configured for SSO, with the attacker targeting the callback mechanism to inject or alter authorization claims. Organizations utilizing this plugin for identity management are at significant risk of identity spoofing and lateral movement within the application.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the user role mapping or profile synchronization logic within the miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin. During the OAuth 2.0 or OpenID Connect flow, the plugin intercepts the identity provider's (IdP) response, which contains user attributes. In vulnerable versions, the plugin fails to strictly validate or sanitize these attributes before assigning them to the local WordPress user account.\nThe exploitation process typically follows a specific attack flow: First, an attacker initiates the OAuth authentication process provided by the plugin. During the callback phase, where the plugin consumes the token and the associated user identity claims, the attacker intercepts the HTTP request containing the identity data. If the plugin uses these claims to map users to roles—specifically looking for administrative flags or attributes that determine WordPress capabilities—the attacker can manipulate the input.\nIf the server-side logic responsible for role assignment does not perform adequate server-side verification of the mapping configuration, the attacker can force the plugin to create or update an existing user account with the 'administrator' role. This is often achieved by manipulating identity claims (e.g., if the plugin improperly trusts an 'is_admin' or 'role' parameter passed by the IdP without secondary validation against the configured mapping rules).\nFurthermore, the vulnerability may involve improper trust in user identity metadata. By exploiting the lack of integrity checks on the profile data returned by the OAuth provider, an attacker can influence the plugin's internal functions that perform user creation or session establishment. Once the 'wp_insert_user' or 'wp_update_user' functions are invoked with elevated roles based on the tampered metadata, the plugin grants the attacker unauthorized access. The vulnerable component is the callback handler function responsible for parsing the authentication response. Because this process occurs at the application layer, no special network privileges are required beyond the ability to trigger the SSO flow. The post-exploitation impact allows for the full execution of arbitrary administrative tasks, such as installing malicious plugins, modifying database entries, or exfiltrating sensitive user credentials, effectively granting the attacker permanent persistence within the WordPress installation."
}