CVE-2025-10753 affects the OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress, where the OAuth redirect functionality lacks proper capability and authentication verification. Specifically, the 'oauthredirect' option parameter can be manipulated by unauthenticated attackers to set the global redirect URL, potentially enabling unauthorized control over redirect behavior. This vulnerability is present in all versions up to and including 6.26.14. The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official fix has been documented in the provided data.

An unauthenticated attacker can modify the global redirect URL option in the affected plugin, which may lead to unauthorized redirection behavior. This could be leveraged to redirect users to malicious sites or facilitate phishing attacks. However, there is no direct confidentiality or availability impact reported. The integrity impact is limited to the redirect URL setting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling or restricting access to the OAuth redirect functionality if possible. Monitoring for unusual redirect URL changes may help detect exploitation attempts. Avoid exposing the affected plugin to untrusted users or public access without additional access controls.