Secufor OAuth

Secufor OAuth adds Single Sign-On (SSO) to WordPress. Visitors sign in with an account they already have — Google, Microsoft, GitHub, Slack and others — instead of creating yet another password on your site. The plugin implements the OAuth 2.0 Authorization Code flow: the visitor is sent to the provider, the provider sends them back with a one-time code, and the plugin exchanges that code for the user's profile server-side. A matching WordPress account is created on first sign-in, or reused on subsequent ones. Features

• Authorization Code flow with a single-use, cookie-bound state parameter (CSRF protection)
• Optional PKCE (S256) for providers that require or recommend it
• Configurable mapping between the provider's claims and WordPress user fields
• One shortcode per configured provider, so you can place the sign-in button anywhere
• Accounts are matched on the provider's stable user identifier, not on e-mail alone
• Provider logos are bundled with the plugin — no third-party CDN is contacted

Included provider presets Google, Microsoft, Microsoft Entra ID, Facebook, Keycloak, Discord, GitHub, GitLab, LinkedIn, WordPress.com, Slack, Amazon, Twitch, Salesforce, AWS Cognito, Dropbox, Zoom, Spotify and Bitbucket. A generic OpenID Connect preset is also included, so any standards-compliant provider can be configured by entering its authorization, token and userinfo endpoints manually. Presets only pre-fill the endpoints and scopes. You still need to register an application with the provider and paste in your own Client ID and Client Secret. Providers that are not supported For transparency, these cannot work with the plugin's server-side Authorization Code flow and are deliberately not offered:

• Sign in with Apple — requires a signed JWT as the client secret and returns the identity in an id_token rather than from a userinfo endpoint.
• X (Twitter) — the authorization code expires after 30 seconds, which is unreliable for a page round-trip.
• Instagram — professional accounts only, and never returns an e-mail address.
• Reddit — never returns an e-mail address, which the plugin needs to create the WordPress account.
• Stripe — Stripe Connect is a payments authorization flow, not an identity provider.

1.1.0

• Security: the secuforoauth_unregister_action AJAX endpoint was reachable by unauthenticated visitors and could disconnect the site from its Secufor account. It now requires the manage_options capability and a valid nonce, and is no longer registered for logged-out users (CVE-2026-7617).
• Security: the OAuth state parameter is now generated per click, stored single-use, and bound to the visitor's browser with a cookie, preventing login CSRF.
• Security: accounts are matched on the provider's stable user identifier; e-mail matching now requires a verified address and never links an account with administrative privileges automatically.
• Security: a provider can no longer set a WordPress role or capability through the attribute mapping.
• Security: the sign-in button markup is regenerated from validated colour and size values instead of being stored as free-form HTML.
• Security: the client secret is no longer rendered back into the configuration form.
• Fixed: sign-in could not complete at all — the user-mapping function was called with the wrong number of arguments, the nonce never returned from the provider, and the user was never actually logged in.
• Fixed: the attribute mapping was applied in the wrong direction, so no claim was ever mapped.
• Fixed: an existing user was re-created on every sign-in instead of being updated.
• Fixed: deleting a provider caused the next one created to overwrite an existing configuration.
• Fixed: refreshing the registration screen created duplicate providers.
• Fixed: LinkedIn used scopes that LinkedIn has retired; the preset now uses OpenID Connect.
• Changed: provider logos are bundled with the plugin instead of being loaded from third-party CDNs.
• Changed: presets added for GitLab, Slack, Amazon, Twitch, Salesforce, AWS Cognito, Dropbox, Zoom, Spotify, Bitbucket, Microsoft Entra ID and generic OpenID Connect.
• Changed: admin scripts and styles are only loaded on the plugin's own screens.