Skip to content
Sign in
4.3 Medium

CVE-2022-3894 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a…

Description

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.

Affected products and versions

Product Affected versions Fixed in
WP OAuth Server (OAuth Authentication) 4.2 earliest → < 4.2.5 4.2.5

Other CVEs of WP OAuth Server (OAuth Authentication)

The 4 CVEs of WP OAuth Server (OAuth Authentication) →
CVE-2022-4148 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check… 4.3 Medium CVE-2022-3926 The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating… 6.5 Medium CVE-2022-3892 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs,… 4.8 Medium
Track this CVE