CVE-2022-3894

low-risk
Published 2023-03-20

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.

Do I need to act?

-
0.12% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Oauth Server

Affected Vendors

Dash10

References (2)

Exploit https://wpscan.com/vulnerability/298487b2-4141-4c9f-9bb2-e1450aefc1a8
Exploit https://wpscan.com/vulnerability/298487b2-4141-4c9f-9bb2-e1450aefc1a8
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal