What’s Vulnerable › Vulnerabilities

CVE-2022-2083: Simple Single Sign On <= 4.1.0 - Authentication Bypass

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-05 · updated 2026-06-17
• Weakness: CWE-319

Description

The Simple Single Sign On WordPress plugin through 4.1.0 leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site.

Affected products

• Simple Single Sign On: through 4.1.0

References

• https://lana.codes/lanavdb/0bab7575-45fc-432d-945e-6100c35c574c/
• https://wpscan.com/vulnerability/2bbfc855-6901-462f-8a93-120d7fb5d268
• https://lana.codes/lanavdb/0bab7575-45fc-432d-945e-6100c35c574c/
• https://wpscan.com/vulnerability/2bbfc855-6901-462f-8a93-120d7fb5d268

Get alerted when CVE-2022-2083 or the next vulnerability affects your stack