Vulnerability · Published Jun 12, 2025 · Assigned by Wordfence
CVE-2025-6003WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure
Medium 5.3
In plain English
A medium-severity incorrect authorization in WordPress Single Sign-On (SSO) - Multisite All-Inclusive from cyberlord92. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cyberlord92 | WordPress Single Sign-On (SSO) - Single Site Standard | 0 – through 18.5.3 |
| cyberlord92 | WordPress Single Sign-On (SSO) - Single Site Premium | 0 – through 28.5.3 |
| cyberlord92 | WordPress Single Sign-On (SSO) - Multisite Premium | 0 – through 30.5.3 |
| cyberlord92 | WordPress Single Sign-On (SSO) - Single Site Enterprise | 0 – through 38.5.3 |
| cyberlord92 | WordPress Single Sign-On (SSO) - Multisite Enterprise | 0 – through 40.5.3 |
| cyberlord92 | WordPress Single Sign-On (SSO) - Single Site All-Inclusive | 0 – through 48.5.3 |
| cyberlord92 | WordPress Single Sign-On (SSO) - Multisite All-Inclusive | 0 – through 50.5.3 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N