What is the CVSS score of CVE-2026-65520?

CVE-2026-65520 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP OAuth Server are affected by CVE-2026-65520?

The miniOrange WP OAuth Server WordPress plugin (versions ≤6.2.0) contains a critical SQL injection vulnerability (CVE-2026-65520, CVSS 9.3) that allows unauthenticated remote attackers to bypass…

How to fix or mitigate CVE-2026-65520?

Within 24 hours: immediately disable and remove the miniOrange WP OAuth Server plugin from all WordPress installations; verify if version 6.2.0 or earlier is deployed across your environment; and review database access logs for exploitation attempts. Within 7 days: conduct a comprehensive database audit for unauthorized data access; change database credentials and review user permissions; contact miniOrange for patch availability and expected timeline; and implement SQL query rate-limiting at the database layer. Within 30 days: deploy a Web Application Firewall rule to block /wp-json/oauth/* endpoints if the plugin must remain enabled pending patch release; perform forensic analysis if compromise is confirmed; and establish quarterly plugin vulnerability scanning procedures before any WordPress updates.

WP OAuth Server CVE-2026-65520

EUVD-2026-53969 CRITICAL

SQL Injection (CWE-89)

2026-08-06 Patchstack

GHSA-75cj-86wv-m74j

WordPress SQLi Wordpress Plugin Wp Oauth Server Miniorange

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) enabling database read (C:H); no integrity/availability change and DB queries stay in-scope, so I:N/A:N/S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:29 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

AnalysisAI

SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis.

Technical ContextAI

WP OAuth Server (cpe:2.3:a:miniorange:wp_oauth_server) is a WordPress plugin that turns a WordPress site into an OAuth 2.0 / OpenID Connect identity provider, issuing tokens and handling authorization endpoints for connected applications. The root cause is CWE-89 (SQL Injection): user-supplied input reaching an OAuth-related endpoint is concatenated into a SQL statement without proper parameterization or sanitization, so crafted input alters query structure. Because OAuth authorize/token endpoints are exposed to unauthenticated clients by design, the injectable surface is reachable pre-authentication, which is consistent with the PR:N metric.

RemediationAI

Upgrade the WP OAuth Server plugin to a release later than 6.2.0 once the vendor publishes it; released patched version is not independently confirmed from the provided data, so verify the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/miniorange-oauth-20-server/vulnerability/wordpress-wp-oauth-server-plugin-6-2-0-sql-injection-vulnerability) and the miniOrange changelog before deploying. Until a patched version is confirmed, restrict access to the plugin's OAuth endpoints with a WAF rule targeting SQL-injection patterns on the OAuth request/authorize/token parameters, or place the OAuth IdP behind IP allowlisting or authentication at the reverse proxy - noting this can break legitimate third-party OAuth clients that need public endpoint access. If OAuth SSO is not actively used, deactivating the plugin removes the exposed attack surface entirely.