Wp Auth0
Monthly
Improper audience validation in the Auth0-PHP SDK versions 8.0.0 through 8.17.0 causes the SDK's token validation routine to treat an ID token as an acceptable access token, so affected applications can be tricked into authorizing API requests with a token that was never meant to grant API access. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5), but exploitation is gated by the attacker's ability to obtain a legitimately issued ID token for the target's own Auth0 tenant, since the token substitution only succeeds against the tenant that issued it. Confidentiality impact is high while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis; the same defect propagates to Auth0's Laravel, Symfony and WordPress integrations that pin the vulnerable SDK range. Vendor-released patch: Auth0-PHP 8.18.0.
A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper audience validation in the Auth0-PHP SDK versions 8.0.0 through 8.17.0 causes the SDK's token validation routine to treat an ID token as an acceptable access token, so affected applications can be tricked into authorizing API requests with a token that was never meant to grant API access. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5), but exploitation is gated by the attacker's ability to obtain a legitimately issued ID token for the target's own Auth0 tenant, since the token substitution only succeeds against the tenant that issued it. Confidentiality impact is high while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis; the same defect propagates to Auth0's Laravel, Symfony and WordPress integrations that pin the vulnerable SDK range. Vendor-released patch: Auth0-PHP 8.18.0.
A stored cross-site scripting (XSS) vulnerability exists in the Auth0 plugin before 4.0.0 for WordPress via the settings page. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross-site request forgery (CSRF) vulnerabilities exist in the Auth0 plugin before 4.0.0 for WordPress via the domain field. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.