CVE-2022-2133

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

Score

CVSS 3.1 5.3 Medium

Status

Modified - contact@wpscan.com

Published

2022-07-17

Last modified

2024-08-03

Weaknesses

CWE-287

Affected products

• Oauth Single Sign On (Miniorange)
• Oauth Single Sign On Sso Oauth Client (Unknown)

References

• https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de