Executive brief
The Secufor_OAuth plugin for WordPress, which handles secure login connections, contains a security flaw that allows unauthorized individuals to disconnect a website from its Secufor account. By exploiting this, an attacker can clear the site's login tokens and configuration settings without needing a password. This could disrupt user authentication services and require administrative intervention to restore site functionality.
Technical details
The Secufor_OAuth plugin for WordPress (versions up to 1.0.7) suffers from a missing authorization check (CWE-862) in its login handling logic. Specifically, the plugin fails to verify if a requester has the appropriate permissions before executing actions that modify its configuration. An unauthenticated remote attacker can exploit this by sending a crafted request to the vulnerable site, resulting in the clearing of the stored OAuth login token and user login configuration. This effectively severs the connection between the WordPress site and the Secufor authentication service. The vulnerability is located in secuforoauth_login.php.
Affected products
- Secufor Secufor_OAuth up to, and including, 1.0.7
Timeline
- 2026-06-24: disclosed: NVD publication date
- 2026-06-24: advisory: Wordfence advisory published
References
- https://plugins.trac.wordpress.org/browser/wpoauth/tags/1.0.7/secuforoauth_login.php
- https://plugins.trac.wordpress.org/browser/wpoauth/tags/1.0.7/secuforoauth_login.php
- https://plugins.trac.wordpress.org/browser/wpoauth/trunk/secuforoauth_login.php
- https://plugins.trac.wordpress.org/browser/wpoauth/trunk/secuforoauth_login.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/61293c20-cabe-412d-94d1-1d0326d35a46?source=cve