CVE-2026-82183 [HIGH] – The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity asser

The OAuth Single Sign On WordPress plugin before 7.0.1 does not verify the identity assertion returned by its Steam single sign-on flow, allowing unauthenticated attackers to log in as an arbitrary non-administrator user, and to create new accounts.