The plugin was affected by an Auth Bypass vulnerability. The plugin leaks its OAuth client_secret, which could be used by attackers to gain unauthorized access to the site. Depending on the settings of the OAuth server, we may even be given an administrator role on the client’s website.