Cyber Posture

CVE-2025-9485

Critical

Published: 04 October 2025

Published
04 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0074 73.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may create a local account to maintain access to victim systems.

Security Summary

CVE-2025-9485, published on 2025-10-04, affects the OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress in versions up to and including 6.26.12. The vulnerability involves improper verification of cryptographic signature (CWE-347), caused by the plugin performing unsafe JWT token processing without verification or validation in the `get_resource_owner_from_id_token` function. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction. Successful exploitation allows bypassing authentication to access any existing user account—including administrators in certain configurations—or to create arbitrary subscriber-level accounts.

Advisories and patches reference the vulnerable code in `class-mooauth-widget.php` at line 577 of version tag 6.26.12, a fix in changeset 3360768 of the plugin repository, and a Wordfence threat intelligence report detailing the issue.

Details

CWE(s)
CWE-347

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078.003 Local Accounts Stealth
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1136.001 Local Account Persistence
Adversaries may create a local account to maintain access to victim systems.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress OAuth plugin enables unauthenticated exploitation (T1190) for authentication bypass to access/use existing local user accounts including admins (T1078.003) or create arbitrary subscriber accounts (T1136.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References