Security release. Fixes an unauthenticated endpoint that could disconnect your Secufor account (CVE-2026-7617), hardens the OAuth flow against login CSRF and account takeover, and repairs the sign-in flow, which did not complete in earlier versions. Upgrading is strongly recommended.<\/p>"},"ratings":{"1":0,"2":0,"3":0,"4":0,"5":2},"assets_icons":{"icon-256x256.png":{"filename":"icon-256x256.png","revision":3253295,"resolution":"256x256","location":"assets","locale":"","width":512,"height":512}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.1","1.0.2","1.0.3","1.0.4","1.0.5","1.0.6","1.0.7","1.0.8","1.1.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[710,2061,43290,5136,2469],"plugin_category":[38],"plugin_contributors":[238256],"plugin_business_model":[],"class_list":["post-205354","plugin","type-plugin","status-closed","hentry","plugin_tags-authentication","plugin_tags-oauth","plugin_tags-openid-connect","plugin_tags-single-sign-on","plugin_tags-sso","plugin_category-authentication","plugin_contributors-secufor","plugin_committers-secufor"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/wpoauth.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"\n
Secufor OAuth adds Single Sign-On (SSO) to WordPress. Visitors sign in with an account they already have \u2014 Google, Microsoft, GitHub, Slack and others \u2014 instead of creating yet another password on your site.<\/p>\n\n
The plugin implements the OAuth 2.0 Authorization Code flow: the visitor is sent to the provider, the provider sends them back with a one-time code, and the plugin exchanges that code for the user's profile server-side. A matching WordPress account is created on first sign-in, or reused on subsequent ones.<\/p>\n\n
state<\/code> parameter (CSRF protection)<\/li>\n- Optional PKCE (S256) for providers that require or recommend it<\/li>\n
- Configurable mapping between the provider's claims and WordPress user fields<\/li>\n
- One shortcode per configured provider, so you can place the sign-in button anywhere<\/li>\n
- Accounts are matched on the provider's stable user identifier, not on e-mail alone<\/li>\n
- Provider logos are bundled with the plugin \u2014 no third-party CDN is contacted<\/li>\n<\/ul>\n\n
Included provider presets<\/h4>\n\n
Google, Microsoft, Microsoft Entra ID, Facebook, Keycloak, Discord, GitHub, GitLab, LinkedIn, WordPress.com, Slack, Amazon, Twitch, Salesforce, AWS Cognito, Dropbox, Zoom, Spotify and Bitbucket.<\/p>\n\n
A generic OpenID Connect preset is also included, so any standards-compliant provider can be configured by entering its authorization, token and userinfo endpoints manually.<\/p>\n\n
Presets only pre-fill the endpoints and scopes. You still need to register an application with the provider and paste in your own Client ID and Client Secret.<\/p>\n\n
Providers that are not supported<\/h4>\n\n
For transparency, these cannot work with the plugin's server-side Authorization Code flow and are deliberately not offered:<\/p>\n\n
\n- Sign in with Apple<\/strong> \u2014 requires a signed JWT as the client secret and returns the identity in an
id_token<\/code> rather than from a userinfo endpoint.<\/li>\n- X (Twitter)<\/strong> \u2014 the authorization code expires after 30 seconds, which is unreliable for a page round-trip.<\/li>\n
- Instagram<\/strong> \u2014 professional accounts only, and never returns an e-mail address.<\/li>\n
- Reddit<\/strong> \u2014 never returns an e-mail address, which the plugin needs to create the WordPress account.<\/li>\n
- Stripe<\/strong> \u2014 Stripe Connect is a payments authorization flow, not an identity provider.<\/li>\n<\/ul>\n\n
External services<\/h3>\n\n
This plugin connects to Secufor<\/strong> (https:\/\/secufor.net) to sign the site administrator in to their Secufor account.<\/p>\n\n\n- When:<\/strong> only from the plugin's admin screens, when an administrator submits the Secufor login form, and when the plugin's main screen is opened.<\/li>\n
- What is sent:<\/strong> the Secufor username and password entered by the administrator, the resulting authentication token, and the plugin identifier (
secuforoauth<\/code>). No site visitor data and no WordPress user data are sent.<\/li>\n- Terms of service: https:\/\/secufor.net\/cgu<\/li>\n<\/ul>\n\n
The plugin also connects to whichever OAuth provider you<\/strong> configure (Google, Microsoft, GitHub, and so on). These connections happen when a visitor clicks a sign-in button: the plugin sends your Client ID and Client Secret together with the authorization code to that provider's token endpoint, and then requests the signing-in user's profile. Which provider is contacted, and therefore whose terms apply, depends entirely on your configuration. No data is sent to any provider you have not configured.<\/p>\n\n\n\n- Upload the plugin folder to
\/wp-content\/plugins\/<\/code>, or install it from the Plugins screen.<\/li>\n- Activate the plugin.<\/li>\n
- Go to Secufor Oauth \u2192 Create OAuth<\/strong> and pick a provider.<\/li>\n
- Register an application with that provider and set its redirect URI to a URL on your site.<\/li>\n
- Paste your Client ID and Client Secret into the plugin, and save.<\/li>\n
- Copy the shortcode shown on the provider's configuration screen and place it on any page or post.<\/li>\n<\/ol>\n\n\n
\nWhat should I use as the redirect URI?<\/h3><\/dt>\nAny URL on your site works, for example your home page. Enter exactly the same value in the plugin and in the provider's application settings \u2014 most providers reject the exchange if the two differ by even a trailing slash.<\/p><\/dd>\n
Why can't my administrator account sign in through a provider?<\/h3><\/dt>\nBy default the plugin refuses to link an existing account that holds administrative privileges to an external provider based on its e-mail address alone, because a misconfigured or hostile provider could otherwise claim your administrator's address. Developers can allow it with the secuforoauth_allow_privileged_email_linking<\/code> filter.<\/p><\/dd>\nCan I change which provider field maps to which WordPress field?<\/h3><\/dt>\nYes. Each provider has a \"Configure Mappages\" section: the key is the claim returned by the provider, the value is the target WordPress field. Editing the mapping is available in the premium version.<\/p><\/dd>\n
Does the plugin work with a page cache?<\/h3><\/dt>\nYes. The sign-in button links to a static URL; the security token is generated when the visitor clicks it, not when the page is rendered.<\/p><\/dd>\n\n<\/dl>\n\n\n
1.1.0<\/h4>\n\n\n- Security:<\/strong> the
secuforoauth_unregister_action<\/code> AJAX endpoint was reachable by unauthenticated visitors and could disconnect the site from its Secufor account. It now requires the manage_options<\/code> capability and a valid nonce, and is no longer registered for logged-out users (CVE-2026-7617).<\/li>\n- Security:<\/strong> the OAuth
state<\/code> parameter is now generated per click, stored single-use, and bound to the visitor's browser with a cookie, preventing login CSRF.<\/li>\n- Security:<\/strong> accounts are matched on the provider's stable user identifier; e-mail matching now requires a verified address and never links an account with administrative privileges automatically.<\/li>\n
- Security:<\/strong> a provider can no longer set a WordPress role or capability through the attribute mapping.<\/li>\n
- Security:<\/strong> the sign-in button markup is regenerated from validated colour and size values instead of being stored as free-form HTML.<\/li>\n
- Security:<\/strong> the client secret is no longer rendered back into the configuration form.<\/li>\n
- Fixed:<\/strong> sign-in could not complete at all \u2014 the user-mapping function was called with the wrong number of arguments, the nonce never returned from the provider, and the user was never actually logged in.<\/li>\n
- Fixed:<\/strong> the attribute mapping was applied in the wrong direction, so no claim was ever mapped.<\/li>\n
- Fixed:<\/strong> an existing user was re-created on every sign-in instead of being updated.<\/li>\n
- Fixed:<\/strong> deleting a provider caused the next one created to overwrite an existing configuration.<\/li>\n
- Fixed:<\/strong> refreshing the registration screen created duplicate providers.<\/li>\n
- Fixed:<\/strong> LinkedIn used scopes that LinkedIn has retired; the preset now uses OpenID Connect.<\/li>\n
- Changed:<\/strong> provider logos are bundled with the plugin instead of being loaded from third-party CDNs.<\/li>\n
- Changed:<\/strong> presets added for GitLab, Slack, Amazon, Twitch, Salesforce, AWS Cognito, Dropbox, Zoom, Spotify, Bitbucket, Microsoft Entra ID and generic OpenID Connect.<\/li>\n
- Changed:<\/strong> admin scripts and styles are only loaded on the plugin's own screens.<\/li>\n<\/ul>","raw_excerpt":"Let visitors sign in to WordPress with an external OAuth 2.0 or OpenID Connect account, using ready-made presets or your own provider.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/205354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=205354"}],"author":[{"embeddable":true,"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/secufor"}],"wp:attachment":[{"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=205354"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=205354"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=205354"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=205354"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=205354"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/fr-ca.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=205354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}