What’s Vulnerable › Vulnerabilities

CVE-2023-1093: OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-03-27 · updated 2026-06-17

Description

The OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attack

Affected products

• miniOrange OAuth Single Sign On – SSO (OAuth Client): before 6.24.2 — fixed in 6.24.2

How to fix

Upgrade to a fixed version: miniOrange OAuth Single Sign On – SSO (OAuth Client) 6.24.2. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d
• https://wpscan.com/vulnerability/1e13b9ea-a3ef-483b-b967-6ec14bd6d54d

Get alerted when CVE-2023-1093 or the next vulnerability affects your stack