CVE-2022-3119

OAuth client Single Sign On for WordPress < 3.0.4 - Unauthenticated Settings Update to Authentication Bypass

State: Published
Severity: 7.5 High
Published: Sep 26, 2022
Updated: May 21, 2025
Reserved: Sep 4, 2022

Description

The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticated attackers to update them and change the OAuth endpoints to ones they controls, allowing them to then be authenticated as admin if they know the correct email address

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N	CISA-ADP

Weaknesses

CWE-287 Improper Authentication
CWE-352 Cross-Site Request Forgery (CSRF)

Affected Products

Product	Versions
OAuth client Single Sign On for WordPress ( OAuth 2.0 SSO )Unknown	3.0.4 to before 3.0.4Affected

References

https://wpscan.com/vulnerability/55b83cee-a8a5-4f9d-a976-a3eed9a558e5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.