The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress suffers from a CSRF vulnerability (CWE-352) because it uses a predictable state parameter (base64 encoded app name) without randomness in the OAuth authorization flow. This flaw enables attackers to craft forged OAuth authorization requests that may be accepted if a site administrator is tricked into interacting with a malicious link, potentially compromising the OAuth session. The vulnerability affects all versions up to 6.26.12. The CVSS v3.1 base score is 4.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, but requiring user interaction and resulting in low impact on integrity without confidentiality or availability impact.

An attacker can exploit this vulnerability to perform CSRF attacks against the OAuth authorization process, potentially hijacking the OAuth flow if a site administrator is tricked into clicking a crafted link. This could lead to unauthorized actions within the OAuth context, impacting the integrity of the authentication process. There is no direct impact on confidentiality or availability reported. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — no official fix or patch links are currently available. Users of the OAuth Single Sign On – SSO (OAuth Client) plugin should monitor the vendor's advisory channels for updates and apply any official patches once released. Until a fix is available, administrators should exercise caution with OAuth authorization requests and avoid interacting with untrusted links that could trigger the OAuth flow.