CVE-2026-19715: WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: WP OAuth Server (Login with WordPress)to a version that resolves this vulnerability.Fixed in 6.3.1 - Configuration
Disable debug logging so the plugin does not write OAuth tokens, authorisation codes, and user records (including password hashes) to the fixed publicly reachable debug log location.
WP OAuth Server (Login with WordPress) debug logging = disable when not required
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using WP OAuth Server versions before 6.3.1 are exposed when the plugin's debug logging is enabled and the debug log remains publicly reachable at its fixed location.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They need only be able to access the publicly reachable debug log while it contains logged OAuth tokens, authorization codes, or user records.
What information may already have been disclosed?
The debug log may contain OAuth tokens, authorization codes, and user records including password hashes. If debug logging was enabled on an affected installation, these records may have been readable by unauthenticated visitors.
What can be done if upgrading is not immediately possible?
Disable debug logging and prevent public access to the debug log file. Treat OAuth tokens and authorization codes recorded in an exposed log as potentially disclosed.