CVE-2023-1092: Miniorange OAuth Single Sign On

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

Affected products

• Miniorange OAuth Single Sign On: before 6.24.2 (fixed in 6.24.2); before 28.4.9 (fixed in 28.4.9); before 38.4.9 (fixed in 38.4.9); before 48.4.9 (fixed in 48.4.9)

Published 2023-03-27. Last modified 2026-06-17.