Plugin icon

WP OAuth Server ( Login with WordPress )

miniorange-oauth-20-server

Vulnerabilities:

5

Last Updated:

October 8, 2026

Active Installs:

1000

Published
Title
Fixed in
CVSS
Published
2026-10-12
Title
WP OAuth Server ( Login with WordPress ) < 6.5.0 - Missing Authorization
Fixed in
Fixed in 6.5.0
CVSS
5.3 (medium)
Published
2026-09-21
Title
WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution
Fixed in
Fixed in 6.4.0
CVSS
9.0 (critical)
Published
2026-08-25
Title
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
Fixed in
Fixed in 6.3.1
CVSS
7.5 (high)
Published
2026-07-28
Title
WP OAuth Server ( Login with WordPress ) < 6.2.1 - Unauthenticated SQL Injection
Fixed in
Fixed in 6.2.1
CVSS
7.5 (high)
Published
2022-06-20
Title
WP OAuth Server ( Login with WordPress ) < 4.0.1 - Authentication Bypass
Fixed in
Fixed in 4.0.1
CVSS
9.8 (critical)