Description

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-06T15:17:15.607Z",
  "pubdate": "2026-08-06T15:17:15.607Z",
  "executiveSummary": "An unauthenticated SQL Injection vulnerability has been identified in the WP OAuth Server plugin. This security flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL payloads into vulnerable parameters. The vulnerability impacts WP OAuth Server versions 6.2.0 and below.\nSuccessful exploitation of this vulnerability can lead to severe security implications, including unauthorized access to sensitive database contents such as user credentials, personally identifiable information (PII), and potential site takeover. Given that the attack requires no authentication or prior privileges, the risk level is critical.\nThreat actors can leverage this flaw over the network via standard HTTP requests without interacting with legitimate users. The vulnerability arises from improper neutralization of user-supplied data before incorporating it into database queries, allowing arbitrary SQL commands to be executed directly against the underlying database management system.",
  "technicalDetails": "The vulnerability resides in the WP OAuth Server plugin for WordPress, specifically affecting versions 6.2.0 and prior. The root cause of the issue is inadequate input sanitization and parameterized query usage when handling user-supplied parameters within the plugin's request handling logic.\nBecause the affected component fails to properly validate and escape input before passing it to database query functions, an unauthenticated attacker can supply specially crafted SQL payloads via HTTP GET or POST requests. This exposes the database to manipulation and unauthorized data extraction.\nThe attack flow proceeds as follows: First, the attacker identifies an exposed endpoint or parameter handled by the vulnerable plugin component. Second, the attacker crafts a malicious HTTP request containing SQL injection payloads designed to manipulate the logical structure of the underlying database query. Third, the unauthenticated request reaches the vulnerable WP OAuth Server code, which improperly concatenates or interpolates the tainted input directly into the SQL statement.\nFinally, the database executes the modified query. Depending on the injected payload, this permits attackers to extract sensitive data via error-based, boolean-based, or time-based blind SQL injection techniques, or potentially modify database records depending on database user privileges and application context.\nNetwork exposure is remote, and the exploitation vector requires no authentication requirements or privilege requirements. Post-exploitation impact includes full confidentiality and integrity breaches of the WordPress database, potentially leading to administrative account creation, remote code execution through plugin/theme manipulation, or full infrastructure compromise."
}