WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure

5.3 CVSS

Vulnerability Description

The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6003

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Israël Hallé

References

More from cyberlord92

View All →

CVE-2025-9891

User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation

Medium 4.3

CVE-2025-9485

OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()

Critical 9.8

CVE-2025-7665

Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation

High 8.1

CVE-2025-14948

miniOrange OTP Verification and SMS Notification for WooCommerce <= 4.3.8 - Missing Authorization to Unauthenticated Notification Settings Modification

Medium 5.3

CVE-2025-12822

WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure

Medium 4.3

Affected Vendor

cyberlord92

View all reports →

Affected Software

WordPress Single Sign-On (SSO) - Single Site Standard, WordPress Single Sign-On (SSO) - Single Site Premium, WordPress Single Sign-On (SSO) - Multisite Premium, WordPress Single Sign-On (SSO) - Single Site Enterprise, WordPress Single Sign-On (SSO) - Multisite Enterprise, WordPress Single Sign-On (SSO) - Single Site All-Inclusive, WordPress Single Sign-On (SSO) - Multisite All-Inclusive

Vulnerable Versions: