CVE-2026-19715: CWE-200 Information Exposure in WP OAuth Server ( Login with WordPress )
Description
WP OAuth Server (Login with WordPress) plugin versions before 6.3.1 do not restrict access to its debug log, which is stored at a fixed, publicly accessible location. This allows unauthenticated users to read sensitive information including OAuth tokens, authorization codes, and user records with password hashes when debug logging is enabled. The vulnerability is identified as CWE-200 (Information Exposure).
CVSS v3.1
Score 7.5high
Affected software
WP OAuth Server ( Login with WordPress )
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WP OAuth Server (Login with WordPress) WordPress plugin prior to version 6.3.1 exposes its debug log without access restrictions. The debug log is stored at a fixed, publicly reachable location, enabling unauthenticated attackers to access OAuth tokens, authorization codes, and user records including password hashes if debug logging is enabled. This constitutes an information exposure vulnerability classified as CWE-200. No official patch or remediation level is stated in the provided data, and no known exploits in the wild are reported.
Potential Impact
An attacker can obtain sensitive OAuth tokens and authorization codes, potentially compromising OAuth sessions. Additionally, user records including password hashes may be exposed, risking user account compromise. The vulnerability allows information disclosure without requiring authentication, increasing the risk of unauthorized access to sensitive data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable debug logging or restrict access to the debug log location to prevent unauthorized access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-13T11:25:44.295Z
- State
- PUBLISHED
Threat ID: 6a8fd7baacd9273b49e174c7
Added to database: 08/27/2026, 06:22:50 UTC
Last enriched: 09/09/2026, 14:37:44 UTC
Last updated: 10/09/2026, 06:48:15 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.