Description

The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack

Related CPE's

a

miniorange

oauth_single_sign_on

*

*

*

*

*

wordpress

Vulnerable

References

https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d

ExploitThird Party Advisory

https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d

ExploitThird Party Advisory

Weaknesses

Could not find any weaknesses

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

6.5 · Medium

  • CVSS V3.1

  • CVSS V3.0

  • CVSS V2.0

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2023-03-27T16:15:09.833

2 years ago

Last modified

2025-02-19T21:15:12.523

4 months ago