PT-2025-25285 · WordPress · Wordpress Single Sign-On (Sso) Plugin

Israël Hallé · Published 2025-06-12 · Updated 2025-08-10 · CVE-2025-6003

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WordPress Single Sign-On (SSO) plugin for WordPress versions prior to 5.3

Description The issue is related to a misconfigured capability check on a function, allowing unauthorized access. This enables unauthenticated attackers to extract sensitive data, including site content restricted to certain users and/or roles.

Recommendations For versions prior to 5.3, update to version 5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and site content until the update is applied.

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-6003

Affected Products

Wordpress Single Sign-On (Sso) Plugin

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6003 · Security Note
• https://twitter.com/CVEnew/status/1933084171498340482 · Twitter Post
• https://plugins.miniorange.com/wordpress-sso · Note
• https://twitter.com/IntCyberDigest/status/1954468581992763563 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1933094046576124405 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/51aa5531-e5b3-4c47-8d06-58eac6dd92fb?source=cve · Note
• https://t.me/cvenotify/125462 · Telegram Post
• https://t.me/cvetracker/26076 · Telegram Post
• https://t.me/secharvester/19805 · Telegram Post