Description
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
Published: 2026-08-06
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability permits any unauthenticated user to inject arbitrary SQL into the database via the WP OAuth Server plugin. This can allow the attacker to read, modify, or delete sensitive data, potentially compromising the entire WordPress database. The weakness is a classic SQL injection (CWE-89).

Affected Systems

miniOrange WP OAuth Server plugin versions 6.2.0 and earlier are affected. The plugin is installed on WordPress sites that use the WP OAuth Server functionality.

Risk and Exploitability

The CVSS score of 9.3 denotes critical severity. The EPSS score is not available, so the current exploitation probability is unknown, and the vulnerability is not listed in the KEV catalog, but the severity alone indicates a high risk. The likely attack vector, inferred from the description, is an unauthenticated web request to a plugin endpoint that fails to properly sanitize user input, enabling SQL injection.

Generated by OpenCVE AI on August 6, 2026 at 15:54 UTC.

Remediation

Vendor Solution

Update the WordPress WP OAuth Server Plugin to the latest available version (at least 6.2.1).

OpenCVE Recommended Actions

  • Install the latest WP OAuth Server plugin (version 6.2.1 or later) immediately.
  • If an update cannot be performed right away, temporarily disable the WP OAuth Server plugin to block unauthenticated access.
  • After remediation, monitor database logs and network traffic for suspicious SQL activity and verify that the issue is resolved.

Generated by OpenCVE AI on August 6, 2026 at 15:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Miniorange
Miniorange wp Oauth Server
Wordpress
Wordpress wordpress
Vendors & Products Miniorange
Miniorange wp Oauth Server
Wordpress
Wordpress wordpress
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 06 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
Title WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L'}

Subscriptions

Miniorange Wp Oauth Server
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-06T15:19:31.742Z

Reserved: 2026-07-22T08:54:01.673Z

Link: CVE-2026-65520

cve-icon Vulnrichment

Updated: 2026-08-06T15:19:26.395Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T16:15:12Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')