OAuth Single Sign On - SSO (OAuth Client) Free < 6.24.2 - IdP Deletion via CSRF

2023-02-2800:00:00

Nguyen Thuc Tuyen

201

oauth single sign on

sso

oauth client

idp deletion

csrf

exploit

EPSS

0.001

Percentile

47.5%

JSON

The plugin does not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

https://example.com/wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=delete&app=wordpress

EPSS

0.001

Percentile

47.5%

JSON

Related for WPEX-ID:8FBF7EFE-0BF2-42C6-AEF1-7FCF2708B31B