Wp Oauth Server
Monthly
SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.3.3. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the miniOrange WP OAuth Server WordPress plugin (all versions up to and including 6.2.0) lets remote unauthenticated attackers inject arbitrary SQL through the plugin's OAuth request handling, per CVSS:3.1 PR:N. The flaw carries a critical 9.3 score with a changed-scope confidentiality impact, meaning attacker-controlled queries can reach data beyond the intended authorization boundary. Reported by Patchstack (CVE-2026-65520 / EUVD-2026-53969); no public exploit identified at time of analysis.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WP OAuth Server OAuth Server.3.3. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.