WordPress Plugin Vulnerabilities

OAuth Single Sign On – SSO (OAuth Client) < 6.23.4 - Improper Authentication

Description

The plugin does not have authorisation in various AJAX actions, which could allow users with a role as low as Subscriber to call them and perform unauthorised actions

Affects Plugins

Plugin icon
miniorange-login-with-eve-online-google-facebook
Fixed in 6.23.4

References

CVE
CVE-2022-34155

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Lana Codes
Verified
Yes
WPVDB ID
d8b092e6-35ab-4b91-82ba-c5760e0d69b3

Timeline

Publicly Published
2023-07-18 (about 2 years ago)
Added
2023-07-20 (about 2 years ago)
Last Updated
2023-07-20 (about 2 years ago)

Other

Published
Title
Published
2024-10-25
Title
Extensions by HocWP Team <= 0.2.3.2 - Authentication Bypass
Published
2016-01-19
Title
Simple Download Monitor <= 3.2.8 - Insufficient Authorisation
Published
2025-02-10
Title
WP Foodbakery <= 4.7 - Authentication Bypass
Published
2022-06-27
Title
OAuth Single Sign On < 6.22.6 - Authentication Bypass
Published
2014-08-01
Title
Easy Photo Album <= 1.1.5 - Album Information Disclosure