CVE-2025-6003

WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure

State: Published
Severity: 5.3 Medium
Published: Jun 12, 2025
Updated: Apr 8, 2026
Reserved: Jun 11, 2025

Description

The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	Wordfence

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
WordPress Single Sign-On (SSO) - Single Site Standardcyberlord92	18.5.3 and earlierAffected
WordPress Single Sign-On (SSO) - Single Site Premiumcyberlord92	28.5.3 and earlierAffected
WordPress Single Sign-On (SSO) - Multisite Premiumcyberlord92	30.5.3 and earlierAffected
WordPress Single Sign-On (SSO) - Single Site Enterprisecyberlord92	38.5.3 and earlierAffected
WordPress Single Sign-On (SSO) - Multisite Enterprisecyberlord92	40.5.3 and earlierAffected
WordPress Single Sign-On (SSO) - Single Site All-Inclusivecyberlord92	48.5.3 and earlierAffected
WordPress Single Sign-On (SSO) - Multisite All-Inclusivecyberlord92	50.5.3 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.