CVE-2022-3894: DASH10 OAuth Server

Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object to be deleted is actually a client, which could allow attackers to make a logged in admin delete arbitrary client and post via a CSRF attack.

Affected products

• DASH10 OAuth Server: before 4.2.5 (fixed in 4.2.5)

Published 2023-03-20. Last modified 2026-06-17.