WordPress Plugin Vulnerabilities

OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

Description

The plugin does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.

Proof of Concept

Affects Plugins

Plugin icon
miniorange-login-with-eve-online-google-facebook
Fixed in 7.0.1

References

CVE
CVE-2026-82183

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
bc7c18f2-4e8c-47a3-a972-6162fd27aaca

Timeline

Publicly Published
2026-08-31 (about 22 days ago)
Added
2026-08-31 (about 22 days ago)
Last Updated
2026-09-21 (about 19 hours ago)

Other

Published
Title
Published
2025-03-06
Title
Homey < 2.4.4 - Limited Authentication Bypass
Published
2026-06-05
Title
Hippoo Mobile App for WooCommerce < 1.9.5 - Unauthenticated Authentication Bypass to Administrator Account Takeover via REST API
Published
2026-03-23
Title
Contest Gallery < 28.1.6 - Unauthenticated Privilege Escalation Admin Account Takeover via Registration Confirmation Email-to-ID Type Confusion
Published
2024-07-19
Title
WooCommerce - Social Login < 2.7.4 - Unauthenticated Privilege Escalation via One-Time Password
Published
2018-11-27
Title
Woo Confirmation Email < 3.2.0 - Missing Access Controls to View Uploaded files