CVE-2025-9485 is a critical vulnerability in the cyberlord92 OAuth Single Sign On – SSO (OAuth Client) WordPress plugin caused by improper verification of cryptographic signatures (CWE-347). The plugin processes JWT tokens unsafely in the get_resource_owner_from_id_token function, lacking proper validation or verification. This allows unauthenticated attackers to bypass authentication mechanisms and impersonate any existing user, including administrators, or create new subscriber-level accounts. The vulnerability affects versions up to and including 6.26.12. The CVSS 3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented.

Successful exploitation enables unauthenticated attackers to bypass authentication and gain unauthorized access to any user account on the affected WordPress site, including administrator accounts in some configurations. Attackers can also create arbitrary subscriber-level accounts. This compromises confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to it as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.