Skip to content
Sign in
6.5 Medium

CVE-2022-3926 The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating…

Description

The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID

Affected products and versions

Product Affected versions Fixed in
WP OAuth Server (OAuth Authentication) 3.4 earliest → < 3.4.2 3.4.2

Other CVEs of WP OAuth Server (OAuth Authentication)

The 4 CVEs of WP OAuth Server (OAuth Authentication) →
CVE-2022-4148 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check… 4.3 Medium CVE-2022-3894 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a… 4.3 Medium CVE-2022-3892 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs,… 4.8 Medium
Track this CVE