WP OAuth Server CVE-2026-107433

Exploitation requires a WordPress installation running the miniOrange WP OAuth Server plugin at version 6.4.0 or earlier, with the affected OAuth/access-control functionality reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, elevated privileges, or user interaction are needed - a remote unauthenticated attacker can reach the vulnerable endpoint against a default-exposed installation. The primary limiting factor is deployment scope: only sites that have this specific OAuth server plugin installed and active are affected, and the description's reference to 'Incorrectly Configured Access Control Security Levels' suggests exposure may be influenced by the plugin's access-control configuration; the exact protected function and any mitigating non-default setting are not detailed in the available data.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the miniOrange WP OAuth Server plugin, scored CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). The CVSS vector indicates a network-exploitable, low-complexity attack requiring no privileges and no user interaction, which raises concern, but the impact is bounded: no confidentiality loss (C:N) and only partial integrity and availability impact (I:L/A:L). No EPSS score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced in the supplied data - so exploitation status is 'no public exploit identified at time of analysis.' Signals are therefore consistent and point to a real-but-not-urgent issue: the unauthenticated network vector means it should be patched promptly, but the absence of KEV listing, POC, and any confidentiality impact argues against treating it as a critical emergency. The single Patchstack reference is the authoritative source and the description is generic ('Exploiting Incorrectly Configured Access Control Security Levels'), so the precise protected function being exposed is not detailed - verify the exact affected endpoint with the Patchstack advisory before prioritizing.

A remote, unauthenticated attacker sends a crafted request directly to a WP OAuth Server plugin endpoint that fails to enforce proper authorization checks, invoking functionality or modifying state they should not be able to reach. Because no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attacker can trigger this against any exposed WordPress site running a vulnerable version (up to and including 6.4.0), resulting in partial integrity and availability impact. No public exploit code is referenced at the time of analysis.