blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-1092

MEDIUM 6.5 CVSS 3.1
Published
March 27, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Description

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

Affected products and versions

  • MiniOrange OAuth Single Sign On Free — Before 6.24.2
  • MiniOrange OAuth Single Sign On Standard — Before 28.4.9
  • MiniOrange OAuth Single Sign On Premium — Before 38.4.9
  • MiniOrange OAuth Single Sign On Enterprise — Before 48.4.9
  • miniorange oauth_single_sign_on — Before 6.24.2
  • miniorange oauth_single_sign_on — Before 28.4.9
  • miniorange oauth_single_sign_on — Before 38.4.9
  • miniorange oauth_single_sign_on — Before 48.4.9

References

  • wpscan.com https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7 Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09c Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31b Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fb Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record