WP OAuth Server CVE-2026-65520

Exploitation requires only that the WP OAuth Server plugin (≤6.2.0) be installed and active on a network-reachable WordPress site, with its OAuth endpoints exposed as in a normal deployment; the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and no special configuration is needed to reach the injectable request handler. The primary limiting factor is that the site must actually run this specific miniOrange plugin at a vulnerable version - sites not using WP OAuth Server, or those that have restricted the OAuth endpoints behind a proxy/WAF, are not exposed. No default-off feature toggle is documented in the provided data.

The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction - the top of the exploitability range, driving the 9.3 critical rating. Impact is skewed to confidentiality (C:H) with only limited availability (A:L) and no integrity impact (I:N), which fits a data-exfiltration-style SQLi rather than authentication bypass or full DB takeover; the changed scope (S:C) reflects that the plugin's queries can expose broader WordPress database contents. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation velocity cannot be quantified from this input. The absence of KEV/POC signals means this is a high-severity-by-vector finding whose actual exploitation likelihood is unconfirmed - treat as a priority patch given unauthenticated reach, but note the risk rating rests on the vector alone.

A remote attacker with no account sends a crafted HTTP request to the plugin's OAuth endpoint with a malicious SQL payload in a vulnerable parameter, causing the injected query to run against the WordPress database. The attacker uses UNION-based or blind techniques to extract user records, password hashes, and OAuth secrets. No public exploit code has been identified, but the low complexity and unauthenticated vector make weaponization straightforward once endpoint details are known.