CVE-2026-19715: WP OAuth Server Information Disclosure Flaw

CVE-2026-19715 Overview

CVE-2026-19715 affects the WP OAuth Server (Login with WordPress) plugin for WordPress in versions before 6.3.1. The plugin writes a debug log to a fixed, publicly reachable location without access restrictions. When debug logging is enabled, unauthenticated attackers can read OAuth tokens, authorization codes, and user records including password hashes. The vulnerability falls under information disclosure and results from insecure file placement combined with missing access control.

Critical Impact
Unauthenticated remote attackers can retrieve OAuth tokens, authorization codes, and WordPress user records including password hashes by requesting the plugin's debug log file directly.

Affected Products

WP OAuth Server (Login with WordPress) WordPress plugin versions before 6.3.1
WordPress installations with the plugin installed and debug logging enabled
Any downstream service relying on OAuth tokens issued by affected installations

Discovery Timeline

2026-08-27 - CVE-2026-19715 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-19715

Vulnerability Analysis

The WP OAuth Server plugin implements OAuth 2.0 flows for WordPress sites, issuing access tokens and authorization codes to client applications. When debug logging is enabled, the plugin writes protocol events to a log file stored at a predictable, static path within the plugin directory. The plugin does not deploy access controls such as .htaccess rules, directory-level authentication, or randomized filenames. Any unauthenticated user who requests the log path over HTTP receives its contents. The log includes issued OAuth tokens, authorization codes, and user records that contain WordPress password hashes.

Root Cause

The vulnerability stems from two combined defects. First, the plugin logs sensitive authentication material rather than redacting or hashing it before writing. Second, the log file is placed inside a web-served directory without protective directives. This pattern maps to Information Exposure through debug information and missing access control on a sensitive resource.

Attack Vector

An unauthenticated attacker performs a direct HTTP GET request to the fixed log path exposed by the plugin. The attacker parses the returned log to extract bearer tokens, one-time authorization codes, and password hashes. Tokens grant impersonation of legitimate OAuth clients and users. Authorization codes can be exchanged for tokens if still valid. Password hashes enable offline cracking against WordPress accounts, including administrators.

See the WPScan Vulnerability Advisory for technical details.

Detection Methods for CVE-2026-19715

Indicators of Compromise

Unauthenticated HTTP GET requests to the WP OAuth Server plugin directory referencing .log or debug filenames
Web server access log entries returning HTTP 200 for requests to wp-content/plugins/ paths associated with the plugin
OAuth token usage from IP addresses that never completed an interactive authorization flow
WordPress account logins following unexplained token issuance or bearer authentication events

Detection Strategies

Search web server access logs for external requests to the plugin's debug log path and flag any non-empty response bodies
Correlate OAuth token issuance events with subsequent API usage from unrelated network origins
Alert on high-entropy string patterns typical of tokens or $P$/$wp$ password hash prefixes appearing in outbound HTTP responses from the WordPress site

Monitoring Recommendations

Enable and retain WordPress and web server access logs with source IP, URI, and response size fields
Monitor authentication and OAuth token usage for anomalies such as reuse across geographies or rapid multi-account access
Track file inventory of the WP OAuth Server plugin directory and alert on the appearance or growth of debug log files

How to Mitigate CVE-2026-19715

Immediate Actions Required

Upgrade the WP OAuth Server (Login with WordPress) plugin to version 6.3.1 or later
Disable debug logging in the plugin configuration until the upgrade is complete
Delete existing debug log files from the plugin directory and confirm they are not cached by any CDN or proxy
Invalidate all OAuth tokens and authorization codes issued while the vulnerable version was running
Force password resets for accounts whose hashes may have been exposed, prioritizing administrators

Patch Information

The vendor addressed CVE-2026-19715 in WP OAuth Server version 6.3.1. Refer to the WPScan Vulnerability Advisory for advisory details and remediation guidance.

Workarounds

Turn off the plugin's debug logging feature to prevent the file from being written
Add a web server rule that denies public access to the plugin's log path, for example an .htaccess deny directive or an equivalent Nginx location block
Move any active log files outside the webroot until the plugin can be updated

bash

# Apache .htaccess rule to block direct access to plugin log files
<FilesMatch "\.log$">
    Require all denied
</FilesMatch>

# Nginx equivalent
location ~* /wp-content/plugins/.*\.log$ {
    deny all;
    return 403;
}