Nguyen Thuc Tuyen

**Name of the Vulnerable Software and Affected Versions** OAuth Single Sign On Free WordPress plugin versions prior to 6.24.2 OAuth Single Sign On Standard WordPress plugin versions prior to 28.4.9 OAuth Single Sign On Premium WordPress plugin versions prior to 38.4.9 OAuth Single Sign On Enterprise WordPress plugin versions prior to 48.4.9 **Description** The issue concerns a lack of CSRF checks when deleting Identity Providers (IdP) in the OAuth Single Sign On WordPress plugins. This could allow attackers to make logged-in admins delete arbitrary IdP via a CSRF attack. **Recommendations** For OAuth Single Sign On Free WordPress plugin versions prior to 6.24.2, update to version 6.24.2 or later. For OAuth Single Sign On Standard WordPress plugin versions prior to 28.4.9, update to version 28.4.9 or later. For OAuth Single Sign On Premium WordPress plugin versions prior to 38.4.9, update to version 38.4.9 or later. For OAuth Single Sign On Enterprise WordPress plugin versions prior to 48.4.9, update to version 48.4.9 or later.