CVE-2026-19715
Received Received - Intake

WP OAuth Server Debug Log Exposure Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: WPScan

Description
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-19715
EUVD
EUVD-2026-66876

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_oauth_server wp_oauth_server to 6.3.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP OAuth Server plugin before version 6.3.1 stores debug log files in a publicly accessible location without access restrictions. This allows unauthenticated users to read sensitive data like OAuth tokens, authorization codes, and user records including password hashes if debug logging is enabled.

Detection Guidance

Check for the presence of debug log files in the WordPress plugins/wp-oauth-server/ directory. Look for files named debug.log or similar in publicly accessible locations. Use commands like 'find /var/www/html -name debug.log' or 'ls -la /path/to/wordpress/wp-content/plugins/wp-oauth-server/' to locate them.

Impact Analysis

Attackers could access OAuth tokens and authorization codes, potentially allowing unauthorized access to user accounts. They could also obtain password hashes, leading to account compromise or further attacks on the system.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA due to unauthorized access to sensitive user data including password hashes. Organizations may face compliance violations, fines, or legal consequences.

Mitigation Strategies

Immediately update the WP OAuth Server plugin to version 6.3.1 or later. Disable debug logging if enabled. Remove any exposed debug log files from public directories. Restrict access to the plugins/wp-oauth-server/ directory to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19715. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart