CVE-2026-82843: CWE-287 Improper Authentication in WP OAuth Server ( Login with WordPress )
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.
AI Analysis
Technical Summary
The WP OAuth Server (Login with WordPress) WordPress plugin prior to version 6.4.0 suffers from CWE-287 Improper Authentication. Specifically, the plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the identity assertion of the last authenticated user, enabling an attacker with at least Subscriber privileges to obtain a valid signed identity assertion for another user, including administrators. This allows unauthorized authentication as that user on any application using the affected site for single sign-on.
Potential Impact
An attacker with Subscriber role or higher can impersonate any user, including administrators, on applications that use the affected WordPress site for single sign-on. This can lead to unauthorized access and potential full compromise of connected applications relying on the plugin's authentication.
Mitigation Recommendations
Upgrade the WP OAuth Server (Login with WordPress) plugin to version 6.4.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the version boundary in the affectedVersions field.
CVE-2026-82843: CWE-287 Improper Authentication in WP OAuth Server ( Login with WordPress )
Description
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.
CVSS v3.1
Score 9.0critical
Affected software
WP OAuth Server ( Login with WordPress )
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP OAuth Server (Login with WordPress) WordPress plugin prior to version 6.4.0 suffers from CWE-287 Improper Authentication. Specifically, the plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the identity assertion of the last authenticated user, enabling an attacker with at least Subscriber privileges to obtain a valid signed identity assertion for another user, including administrators. This allows unauthorized authentication as that user on any application using the affected site for single sign-on.
Potential Impact
An attacker with Subscriber role or higher can impersonate any user, including administrators, on applications that use the affected WordPress site for single sign-on. This can lead to unauthorized access and potential full compromise of connected applications relying on the plugin's authentication.
Mitigation Recommendations
Upgrade the WP OAuth Server (Login with WordPress) plugin to version 6.4.0 or later, where this vulnerability is fixed. No other mitigations are specified. Patch status is confirmed by the version boundary in the affectedVersions field.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-31T08:27:13.691Z
- State
- PUBLISHED
Threat ID: 6ab36d3ff7a7c541065abc9c
Added to database: 09/23/2026, 06:10:07 UTC
Last enriched: 09/23/2026, 06:33:18 UTC
Last updated: 09/24/2026, 01:57:05 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.