This vulnerability arises from missing authorization checks in the miniOrange WP OAuth Server plugin, allowing attackers to bypass intended access controls. The flaw can lead to unauthorized viewing or modification of sensitive data managed by the plugin, compromising confidentiality and integrity within WordPress sites that rely on OAuth for authentication. The weakness is classified as CWE-862, an Access Control Failure.

The issue affects the miniOrange WP OAuth Server plugin for WordPress, with all released versions up through 6.4.0 vulnerable. Sites running this plugin before upgrading to at least 6.5.0 are at risk.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the KEV catalog. Based on the description, it is inferred that an attacker might send crafted requests to the OAuth endpoints exposed by WordPress to access resources reserved for authenticated users; however, no public exploit has been reported. The risk primarily arises from the existence of the authorization flaw rather than from a known, active exploitation campaign.