OAuth Single Sign On – SSO plugin privilege escalation flaw

Summary

A privilege assignment flaw in the OAuth Single Sign On – SSO plugin for WordPress lets an attacker escalate privileges. Versions up to and including 7.1.3 are affected.

What to do

Update to 7.1.4 or later.

Products and platforms

• OAuth Single Sign On – SSO (OAuth Client)

CVE IDs

• CVE-2026-120844 (opens in a new tab)

Sources

• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 08:00 UTC

First seen 2026-11-09 17:40 UTC