CVE-2022-3926: WP OAuth Server < 3.4.2 - Client Secret Regeneration via CSRF

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-05 · updated 2026-06-17
Weakness: CWE-352

Description

The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to make logged in admins regenerate the secret of an arbitrary client given they know the client ID

Affected products

WP OAuth Server (OAuth Authentication): before 3.4.2 — fixed in 3.4.2

How to fix

Upgrade to a fixed version: WP OAuth Server (OAuth Authentication) 3.4.2. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/e1fcde2a-91a5-40cb-876b-884f01c80336
https://wpscan.com/vulnerability/e1fcde2a-91a5-40cb-876b-884f01c80336

Get alerted when CVE-2022-3926 or the next vulnerability affects your stack