CVE-2023-1092

OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

State: Published
Severity: 6.5 Medium
Published: Mar 27, 2023
Updated: Feb 19, 2025
Reserved: Feb 28, 2023

Description

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
OAuth Single Sign On FreeMiniOrange	before 6.24.2Affected
OAuth Single Sign On StandardMiniOrange	before 28.4.9Affected
OAuth Single Sign On PremiumMiniOrange	before 38.4.9Affected
OAuth Single Sign On EnterpriseMiniOrange	before 48.4.9Affected

References

https://wpscan.com/vulnerability/8fbf7efe-0bf2-42c6-aef1-7fcf2708b31bexploitvdb-entrytechnical-description
https://wpscan.com/vulnerability/f6e165d9-2193-4c76-ae2d-618a739fe4fbexploitvdb-entrytechnical-description
https://wpscan.com/vulnerability/52e29f16-b6dd-4132-9bb8-ad10bd3c39d7exploitvdb-entrytechnical-description
https://wpscan.com/vulnerability/5eb85df5-8aab-4f30-a401-f776a310b09cexploitvdb-entrytechnical-description

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.