CVE-2025-6003: 
WordPress vulnerability analysis and mitigation

The WordPress Single Sign-On (SSO) plugin contains a vulnerability (CVE-2025-6003) related to unauthorized access due to a misconfigured capability check. This vulnerability affects all versions up to and including *.5.3 versions of the plugin. The vulnerability was discovered and disclosed on June 11, 2025, with initial public disclosure on June 12, 2025 (NVD Database, Wiz).

The vulnerability stems from a misconfigured capability check on a function within the WordPress Single Sign-On (SSO) plugin. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability has been classified under CWE-863 (Incorrect Authorization) (NVD Database, Wiz).

The vulnerability allows unauthenticated attackers to extract sensitive data, including site content that has been restricted to certain users and/or roles. This could lead to unauthorized access to protected information (NVD Database).

Users should update their WordPress Single Sign-On (SSO) plugin to a version newer than *.5.3 once available. No specific workarounds have been publicly disclosed at this time (Plugin Website).