WP OAuth Server ( Login with WordPress ) vulnerabilities
We track 2 vulnerabilities in WP OAuth Server ( Login with WordPress ) products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest WP OAuth Server ( Login with WordPress ) vulnerabilities
- 9.0 Critical severity
WP OAuth Server ( Login with WordPress ): Improper Authentication
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most
- 7.5 High severity
WP OAuth Server ( Login with WordPress ): Exposure of Sensitive Information to an Unauthorized Actor
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisatio