Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

WP OAuth Server lets subscriber pretend to be another user

CVE-2026-82843 · published 19 days ago
Summary

The WP OAuth Server plugin for WordPress (versions before 6.4.0) can give a low‑level subscriber a forged login token that belongs to another account, even an administrator. This means the subscriber could sign in to any connected app as that other user. Update the plugin to version 6.4.0 or later, or remove it until you can apply the fix.

What to do
  • Update unknown wp oauth server ( login with wordpress ) to version 6.4.0 or later.
Affected software
VendorProductAffected versions
unknown wp oauth server ( login with wordpress ) < 6.4.0
Original advisory text
WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published23 Sep 2026
Updated7 Oct 2026
First seen23 Sep 2026
Sources
CVE-2026-82843 · NVD
CVE-2026-82843 · MITRE
Track software like this
Free during beta