Skip to content
Sign in
4.3 Medium

CVE-2022-4148 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check…

Description

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client.

Affected products and versions

Product Affected versions Fixed in
WP OAuth Server (OAuth Authentication) 4.3 earliest → < 4.3.0 4.3.0

Other CVEs of WP OAuth Server (OAuth Authentication)

The 4 CVEs of WP OAuth Server (OAuth Authentication) →
CVE-2022-3894 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a… 4.3 Medium CVE-2022-3926 The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating… 6.5 Medium CVE-2022-3892 The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs,… 4.8 Medium
Track this CVE