CVE-2022-2133
OAuth Single Sign On < 6.22.6 - Authentication Bypass
MEDIUM 5.3EPSS 1.2%
The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.
- Affected
- OAuth Single Sign On – SSO (OAuth Client)
- CVSS v3.1 NVD
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS v2.0 NVD
- 5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N - EPSS
- 1.21% chance of exploitation in the next 30 days, 68th percentile
- Published
- 2022-07-17
- Updated
- 2024-08-03