Description

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-27T06:16:57.440Z",
  "pubdate": "2026-08-27T06:16:57.440Z",
  "executiveSummary": "The WP OAuth Server (Login with WordPress) plugin prior to version 6.3.1 contains an improper access control vulnerability regarding its debug logging mechanism. The plugin writes sensitive diagnostic information, including OAuth tokens, authorization codes, and WordPress user records containing password hashes, to a static, publicly accessible file path.\nThis vulnerability is classified as an information disclosure flaw. It allows unauthenticated remote attackers to access highly sensitive credentials and authentication tokens without requiring any valid session or administrative privileges. The risk implication is critical, as successful exploitation results in full account takeover, unauthorized API access, and potential escalation of privileges by leveraging the exposed password hashes for offline cracking or direct authentication.\nExploitation is trivial, requiring only that the debug logging feature be enabled within the plugin's configuration, followed by a direct HTTP GET request to the known, unprotected file location. Given that debug logs are often enabled during troubleshooting, the attack surface is significant for any installation where logging has been activated and not subsequently cleared or restricted.",
  "technicalDetails": "The root cause of this vulnerability lies in the plugin's implementation of debug logging, which fails to enforce access control checks or utilize secure, non-public directory paths for sensitive data storage. When the debug logging feature is active, the plugin creates a persistent log file at a fixed location within the web-accessible directory structure of the WordPress installation.\nThe vulnerability occurs because the plugin lacks an '.htaccess' rule, 'web.config' restriction, or internal logic to gate access to the log file based on user roles or capabilities. Consequently, any HTTP client capable of reaching the web server can retrieve the contents of this file by simply requesting the specific URL path.\nThe attack flow proceeds as follows: First, an attacker identifies a target site running an affected version of WP OAuth Server. Second, the attacker verifies if debug logging is enabled—a common scenario in development or troubleshooting environments—by attempting to access the known static file path. Third, once the file is accessed, the attacker parses the log output. Because the plugin logs raw request/response objects, the data captured includes active OAuth authorization codes, bearer access tokens, and serialized WordPress user objects containing sensitive metadata such as encrypted password hashes.\nPost-exploitation, the attacker possesses the necessary components to compromise user accounts. OAuth tokens may be utilized to impersonate users or gain unauthorized access to protected resources integrated with the OAuth server. Furthermore, the exposure of WordPress user records, specifically hashed password values, enables attackers to perform offline brute-force or dictionary attacks to obtain plaintext credentials, facilitating broader unauthorized access to the WordPress administrative backend.\nThe vulnerability affects all instances of the WP OAuth Server plugin before version 6.3.1. There are no authentication or privilege requirements to exploit this flaw, as the file resides outside of the standard WordPress authentication middleware. Exposure is limited only by the visibility of the web server to the public internet and the internal state of the plugin's configuration."
}