CVE-2026-107433: WP OAuth Server Auth Bypass Vulnerability

CVE-2026-107433 Overview

CVE-2026-107433 is a Missing Authorization vulnerability [CWE-862] in the miniOrange WP OAuth Server plugin (miniorange-oauth-20-server) for WordPress. The flaw affects all plugin versions up to and including 6.4.0. Attackers can exploit incorrectly configured access control security levels over the network without authentication or user interaction. Successful exploitation permits limited impact to integrity and availability on affected WordPress sites running the plugin. Site administrators relying on the WP OAuth Server plugin to broker OAuth 2.0 authentication for connected applications are exposed until the plugin is upgraded to a patched release.

Critical Impact
Unauthenticated network attackers can reach protected plugin functions on vulnerable WordPress sites and influence integrity and availability of OAuth server operations.

Affected Products

miniOrange WP OAuth Server (miniorange-oauth-20-server) WordPress plugin
All versions from n/a through 6.4.0
WordPress sites exposing plugin endpoints to the public internet

Discovery Timeline

2026-10-14 - CVE-2026-107433 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-107433

Vulnerability Analysis

The WP OAuth Server plugin exposes functionality that lacks proper authorization checks. One or more plugin actions do not validate whether the requesting user holds the necessary capability or role before executing privileged logic. An unauthenticated attacker can therefore invoke endpoints that should be restricted to administrators or authorized OAuth operators.

Because the plugin brokers OAuth 2.0 flows, missing authorization on administrative or configuration endpoints can allow modification of OAuth server state. The confidentiality impact is rated none, but integrity and availability can be degraded, which is consistent with tampering actions rather than data exfiltration.

Root Cause

The root cause is a Broken Access Control weakness classified under CWE-862: Missing Authorization. The plugin registers callbacks or REST routes that execute sensitive operations without calling WordPress capability checks such as current_user_can() or verifying nonces tied to privileged roles. The plugin treats reachable requests as authorized by default.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint. No credentials, user interaction, or elevated privileges are required. The vulnerability manifests whenever the plugin processes the request through the unprotected code path. See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-107433

Indicators of Compromise

Unexpected HTTP requests to WP OAuth Server plugin paths under /wp-admin/admin-ajax.php or REST routes referencing miniorange-oauth from unauthenticated clients.
Unexplained changes to OAuth client registrations, scopes, redirect URIs, or plugin settings in the WordPress database.
Spikes in 200-status responses from plugin endpoints originating from a single IP or user agent not associated with legitimate administrators.

Detection Strategies

Audit WordPress access logs for requests to miniorange-oauth-20-server endpoints that do not carry a valid authenticated session cookie.
Compare the current list of registered OAuth clients and plugin configuration against a known-good baseline.
Deploy a Web Application Firewall (WAF) rule that blocks unauthenticated requests to administrative plugin actions.

Monitoring Recommendations

Enable WordPress audit logging for plugin settings changes and OAuth client lifecycle events.
Forward web server access logs to a centralized SIEM and alert on anomalous access patterns to plugin paths.
Monitor outbound OAuth token issuance volume for sudden deviations that may indicate abuse of a tampered configuration.

How to Mitigate CVE-2026-107433

Immediate Actions Required

Identify all WordPress installations running the miniOrange WP OAuth Server plugin and inventory the installed version.
Update the plugin to a release later than 6.4.0 once the vendor publishes a fixed version.
Rotate OAuth client secrets and review registered OAuth clients for unauthorized entries.
Restrict access to WordPress administrative paths through IP allowlisting or VPN where feasible.

Patch Information

The vulnerability affects WP OAuth Server versions from n/a through 6.4.0. Administrators should consult the Patchstack Vulnerability Report and the plugin changelog on WordPress.org for the fixed release and apply it across all affected sites.

Workarounds

Deactivate the WP OAuth Server plugin until a patched version is installed if OAuth brokering is not business-critical.
Place a WAF rule in front of the site to block unauthenticated requests to plugin-specific administrative endpoints.
Limit access to /wp-admin/ and the plugin's REST namespace to trusted source IP ranges at the edge or reverse proxy.

bash

# Example nginx configuration restricting plugin admin paths to trusted IPs
location ~* /wp-admin/admin-ajax\.php {
    if ($arg_action ~* "mo_oauth") {
        allow 203.0.113.0/24;
        deny all;
    }
}