CVE-2026-65520: WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

Published Aug 6, 2026

Updated

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

Affected Software

1 affected component

WordPress WP OAuth Server<=6.2.0

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WP OAuth Server Plugin to a version that resolves this vulnerability.
Fixed in 6.2.1

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-65520 is classified as critical with a score of 9.3.

CVE-2026-65520 identifies an unauthenticated SQL Injection vulnerability in WP OAuth Server versions <= 6.2.0.

To fix CVE-2026-65520, update the WP OAuth Server plugin to the latest version beyond 6.2.0.

Yes, CVE-2026-65520 is exploitable without authentication, making it particularly dangerous.

CVE-2026-65520 affects the WordPress WP OAuth Server plugin.