Authentication vulnerability in WordPress OpenID Connect Client 2.1.7

The WordPress OpenID Connect Client plugin is a tool for WordPress that allows users to log in to a WordPress website with their email address. Unfortunately, versions up to and including 2.1.7 of this plugin have a major security flaw. Attackers can use this vulnerability to access the website as a site administrator, even if they don’t know the password, as long as they have access to a site admin’s email address. This is because the plugin takes the user-supplied email address and passes it to the wp_set_auth_cookie() function without verifying that the user who provided the email address is actually the one trying to log in.