CVE-2026-19715

HighCVSS 7.5

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

The WP OAuth Server (Login with WordPress) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.

Risk Assessment

Exposure of OAuth tokens and password hashes can lead to account takeover and compromise of the entire WordPress installation.

Recommendation

Update the plugin to version 6.3.1 or later. Disable debug logging if not needed and ensure log files are not publicly accessible.

Other vulnerabilities in WP OAuth Server

CVE-2026-65520Critical
Unauthenticated SQL Injection vulnerability in WP OAuth Server versions up to 6.2.0.

Original NVD description (English source)

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.