CVE-2023-1092: OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-1092.
What is the severity of CVE-2023-1092?
The severity of CVE-2023-1092 is medium with a severity value of 6.5.
Which plugins are affected by CVE-2023-1092?
The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9, and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 are affected by CVE-2023-1092.
What is the vulnerability description for CVE-2023-1092?
CVE-2023-1092 is a vulnerability in the OAuth Single Sign On plugins for WordPress that allows an attacker to delete Identity Providers without CSRF checks.
How can I fix CVE-2023-1092?
To fix CVE-2023-1092, update the OAuth Single Sign On Free WordPress plugin to version 6.24.2 or higher, OAuth Single Sign On Standard WordPress plugin to version 28.4.9 or higher, OAuth Single Sign On Premium WordPress plugin to version 38.4.9 or higher, and OAuth Single Sign On Enterprise WordPress plugin to version 48.4.9 or higher.