CVE-2023-1092
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do…
Does this matter?
Lower severity and a low EPSS score (0.44%). Track it; it rarely justifies an emergency change on its own.
Description
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- EPSS
- 0.44% probability · 37th percentile
- CISA KEV
- Not listed
- Affected
- miniorange/oauth single sign on
- Source
- contact@wpscan.com
References
- https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09cExploit, Third Party Advisory
- https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31bExploit, Third Party Advisory
- https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fbExploit, Third Party Advisory
- https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7Exploit, Third Party Advisory
- https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09cExploit, Third Party Advisory
- https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31bExploit, Third Party Advisory
- https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fbExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.