CVE-2026-107433: WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
miniorange-oauth-20-serverto a version that resolves this vulnerability.Fixed in 6.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects miniOrange WP OAuth Server versions through 6.4.0. The affected range is listed as starting from an unspecified earlier version.
Can this be exploited remotely without an account or user interaction?
Yes. The supplied CVSS vector indicates network access, low attack complexity, no privileges required, and no user interaction required.
What is the potential impact of successful exploitation?
The supplied CVSS vector indicates no confidentiality impact, with low integrity and low availability impact. The vulnerability is described as missing authorization caused by incorrectly configured access-control security levels.