Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com

CVE-2022-2133

Description

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

POC

Reference

- https://wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32de

Github

- https://github.com/20142995/nuclei-templates

- https://github.com/ARPSyndicate/cvemon