What’s Vulnerable › Vulnerabilities

CVE-2015-9435

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-26 · updated 2026-06-17
• Weakness: CWE-338

Description

The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.

Affected products

• Dash10 Oauth Server: before 3.1.5 — fixed in 3.1.5

How to fix

Upgrade to a fixed version: Dash10 Oauth Server 3.1.5. Check the vendor advisory for mitigations.

References

• https://security.dxw.com/advisories/the-oauth2-complete-plugin-for-wordpress-uses-a-pseudorandom-number-generator-which-is-non-cryptographically-secure/
• https://wordpress.org/plugins/oauth2-provider/#developers
• https://security.dxw.com/advisories/the-oauth2-complete-plugin-for-wordpress-uses-a-pseudorandom-number-generator-which-is-non-cryptographically-secure/
• https://wordpress.org/plugins/oauth2-provider/#developers

Get alerted when CVE-2015-9435 or the next vulnerability affects your stack