CVE-2025-6003

The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - security@wordfence.com

Published

2025-06-12

Last modified

2026-04-08

Weaknesses

CWE-863

Affected products

• Wordpress Single Sign-on Sso - Multisite All-inclusive (Cyberlord92)
• Wordpress Single Sign-on Sso - Multisite Enterprise (Cyberlord92)
• Wordpress Single Sign-on Sso - Multisite Premium (Cyberlord92)
• Wordpress Single Sign-on Sso - Single Site All-inclusive (Cyberlord92)
• Wordpress Single Sign-on Sso - Single Site Enterprise (Cyberlord92)
• Wordpress Single Sign-on Sso - Single Site Premium (Cyberlord92)
• Wordpress Single Sign-on Sso - Single Site Standard (Cyberlord92)

References

• https://plugins.miniorange.com/wordpress-sso
• https://www.wordfence.com/threat-intel/vulnerabilities/id/51aa5531-e5b3-4c47-8d06-58eac6dd92fb?source=cve