CVE-2022-3894: WP OAuth Server < 4.2.5 - Arbitrary Post Deletion via CSRF

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-20 · updated 2026-06-17

Description

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.

Affected products

Dash10 Oauth Server: before 4.2.5 — fixed in 4.2.5

How to fix

Upgrade to a fixed version: Dash10 Oauth Server 4.2.5. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/298487b2-4141-4c9f-9bb2-e1450aefc1a8
https://wpscan.com/vulnerability/298487b2-4141-4c9f-9bb2-e1450aefc1a8

Get alerted when CVE-2022-3894 or the next vulnerability affects your stack