55 matches found
WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.4.0 - Subscriber+ Cross-User Account Takeover vulnerability
Subscriber+ Cross-User Account Takeover vulnerability discovered by vuxvinh in WordPress Plugin WP OAuth Server versions 6.4.0...
CVE-2026-82843
The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...
CVE-2026-82843 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution
The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...
CVE-2026-82843 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution
The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...
EUVD-2026-85030
The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...
CVE-2026-82843
The WP OAuth Server (Login with WordPress) WordPress plugin, in versions before 6.4.0 , is vulnerable to a cross-user account takeover due to an improper authentication flaw. The plugin fails to bind the issued OpenID Connect identity assertion to the specific authorization grant being exchanged....
PT-2026-97166
Name of the Vulnerable Software and Affected Versions WP OAuth Server Login with WordPress versions prior to 6.4.0 Description The plugin fails to bind the OpenID Connect identity assertion to the authorization grant being exchanged. Instead, it returns the assertion of the most recently...
CVE-2026-82843: Improper Authentication
The WP OAuth Server Login with WordPress WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the...
WordPress WP OAuth Server ( Login with WordPress ) plugin < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure vulnerability
Unauthenticated OAuth Token and User Data Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WP OAuth Server versions 6.3.1...
CVE-2026-19715
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
EUVD-2026-66876
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
CVE-2026-19715
The WP OAuth Server ( Login with WordPress ) WordPress plugin in versions before 6.3.1 is vulnerable to an unauthenticated information disclosure. When debug logging is enabled, the plugin writes to a debug log stored at a fixed and publicly reachable location without restricting access. This all...
CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
CVE-2026-19715: Exposure of Sensitive Information to an Unauthorized Actor
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
PT-2026-82392
The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...
CVE-2026-65520 WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-65520: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
