Unknown Wp OAuth Server Login With WordPress vulnerabilities

2 CVEs affecting Unknown Wp OAuth Server Login With WordPress, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-82843, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-19715, published 2026-08-27. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing…
CVE-2026-82843, published 2026-09-23. Critical severity, CVSS 9.0. EPSS: 0.2% chance of exploitation in the next 30 days. The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead…