CVE-2025-9485WordPress OAuth SSO plugin JWT bypass, admin takeover

What broke

The OAuth SSO plugin for WordPress (through 6.26.12) did not verify JWT signatures correctly. An attacker could mint a token and become an administrator. Fixed in 6.26.13.

Why it matters

WordPress is not an IdP, but it is often the first SSO-enabled public site a company ships. A plugin that "adds OAuth" and then skips signature checks is how a marketing CMS becomes a privileged foothold. The same class as node-jws and SimpleHelp: the token is trusted because it looks like a token.

What to do

• Update the plugin to 6.26.13 or later. If you cannot, disable SSO on that site.
• Review WordPress administrator accounts created around the disclosure window.
• Do not point production OIDC at a plugin you have not seen verify signatures against a JWKS.

After you patch

Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.

• Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
• Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
• Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
• Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of alg: none. See JWT and the validate a JWT recipe.

Sources

• NVD: CVE-2025-9485