CVE-2026-107433

Deferred Deferred - Pending Action

Missing Authorization in miniOrange WP OAuth Server

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Patchstack

Description

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-107433

EUVD

EUVD-2026-101008

Affected Vendors & Products

Vendor	Product	Version / Range
miniOrange	WP	OAuth Server 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Missing Authorization vulnerability in the miniOrange WP OAuth Server plugin for WordPress. It allows unauthorized users to access restricted pages or perform actions they shouldn't due to incorrectly configured access control security levels. The vulnerability affects versions up to and including 6.4.0.

Detection Guidance

Check if the WP OAuth Server plugin version is 6.4.0 or below using WordPress admin panel or via command: wp plugin list | grep miniorange-oauth-20-server. Monitor for unauthorized access attempts or unusual activity in server logs.

Impact Analysis

Unauthorized users could access sensitive data or perform restricted actions on your WordPress site. The vulnerability has a CVSS score of 6.5, indicating moderate danger, and is expected to be targeted in mass campaigns. Attackers may exploit it to gain unauthorized access or manipulate site functions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR or HIPAA compliance requirements. Exposure of user data or restricted information may result in legal penalties or loss of certification.

Mitigation Strategies

Update the WP OAuth Server plugin to version 6.5.0 immediately. Apply Patchstack's mitigation rule if available to block attacks until the update is complete. Review and restrict access controls for sensitive pages.

Hi! I’m here to help you understand CVE-2026-107433. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70