CVE-2025-10752

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10752", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T20:37:57.485Z", "datePublished": "2025-09-26T01:47:27.527Z", "dateUpdated": "2026-04-08T17:30:41.766Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:41.766Z"}, "affected": [{"vendor": "cyberlord92", "product": "OAuth Single Sign On \u2013 SSO (OAuth Client)", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.26.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The OAuth Single Sign On \u2013 SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "title": "OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d7e8f3-e8ff-460f-a343-807bcdb865dc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L285"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3360768%40miniorange-login-with-eve-online-google-facebook&new=3360768%40miniorange-login-with-eve-online-google-facebook&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-09-25T13:34:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-26T19:24:31.437473Z", "id": "CVE-2025-10752", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T19:24:44.021Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10752", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-26T19:24:31.437473Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-26T19:24:39.220Z"}}], "cna": {"title": "OAuth Single Sign On \u2013 SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "cyberlord92", "product": "OAuth Single Sign On \u2013 SSO (OAuth Client)", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "6.26.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-25T13:34:18.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d7e8f3-e8ff-460f-a343-807bcdb865dc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L285"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3360768%40miniorange-login-with-eve-online-google-facebook&new=3360768%40miniorange-login-with-eve-online-google-facebook&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The OAuth Single Sign On \u2013 SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-26T01:47:27.527Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10752", "state": "PUBLISHED", "dateUpdated": "2025-09-26T19:24:44.021Z", "dateReserved": "2025-09-19T20:37:57.485Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-26T01:47:27.527Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "OAuth Single Sign On \u2013 SSO (OAuth Client)", "vendor": "cyberlord92", "versions": [{"lessThanOrEqual": "6.26.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The OAuth Single Sign On \u2013 SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12. This is due to using a predictable state parameter (base64 encoded app name) without any randomness in the OAuth flow. This makes it possible for unauthenticated attackers to forge OAuth authorization requests and potentially hijack the OAuth flow via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."}, {"lang": "es", "value": "El plugin OAuth Single Sign On - SSO (cliente OAuth) para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n en sitios cruzados en todas las versiones hasta e incluyendo la 6.26.12. Esto se debe al uso de un par\u00e1metro de estado predecible (nombre de aplicaci\u00f3n codificado en base64) sin ninguna aleatoriedad en el flujo de OAuth. Esto permite que atacantes no autenticados forjen peticiones de autorizaci\u00f3n OAuth y potencialmente secuestren el flujo de OAuth a trav\u00e9s de una petici\u00f3n falsificada siempre que puedan enga\u00f1ar a un administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace."}], "id": "CVE-2025-10752", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10752", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-26T19:24:31.437473Z", "version": "2.0.3"}}]}, "published": "2025-09-26T02:15:51.530", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/miniorange-login-with-eve-online-google-facebook/tags/6.26.12/class-mooauth-widget.php#L285"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3360768%40miniorange-login-with-eve-online-google-facebook&new=3360768%40miniorange-login-with-eve-online-google-facebook&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e8d7e8f3-e8ff-460f-a343-807bcdb865dc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:47:42.230406+00:00", "value": {"mitigation_remediation": ["Update the OAuth Single Sign On \u2013 SSO (OAuth Client) plugin to the latest release (6.26.13 or later) when available to remove the predictable state limitation.", "If a patch is not yet released, disable or uninstall the plugin until the vendor issues a fix, or restrict its deployment to a sandboxed environment.", "Conduct an audit of administrator accounts to ensure only trusted personnel have access and educate them about the risks of clicking suspicious links."], "summary": {"action": "Patch Now", "impact": "OAuth hijacking via CSRF"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the OAuth Single Sign On \u2013 SSO (OAuth Client) plugin distributed by cyberlord92. All installations running version 6.26.12 or earlier are affected. No other WordPress plugins or system components are reported to be impacted.", "description_and_impact": "The OAuth Single Sign On \u2013 SSO (OAuth Client) plugin for WordPress uses a predictable state parameter, based on a base64 encoded application name, without any randomness in the OAuth flow. This flaw allows an unauthenticated attacker to forge OAuth authorization requests and hijack the flow if a site administrator is tricked into clicking a crafted link. The result is potential unauthorized access to user accounts or impersonation of the administrator, qualifying as a CSRF weakness. ", "risk_and_exploitability": "The reported CVSS score of 4.3 places the issue in the low\u2011to\u2011moderate severity range, while the EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires a CSRF attack against an administrator who is persuaded to click a malicious link, and the attacker must predict the opaque state value. Because of these requirements, the risk to most organizations remains limited unless the plugin is the sole OAuth provider in use or administrators are highly susceptible to phishing. "}}}}, "created": "2025-09-26T11:35:21.451029+00:00", "updated": "2026-04-22T01:00:04.354107+00:00", "vendors": ["oauth_client_single_sign_on_project", "oauth_client_single_sign_on_project$PRODUCT$oauth_client_single_sign_on", "wordpress", "wordpress$PRODUCT$wordpress"]}