This vulnerability (CVE-2026-65520) is an unauthenticated SQL Injection in miniOrange WP OAuth Server versions <= 6.2.0. It is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The CVSS 3.1 score is 9.3 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a significant confidentiality impact with limited availability impact. No vendor advisory or patch information is currently provided, and the product is not a cloud service, so remediation depends on vendor patch release.

An attacker can exploit this vulnerability remotely without authentication to inject SQL commands, potentially leading to unauthorized disclosure of sensitive data (high confidentiality impact) and limited disruption of service (low availability impact). Integrity impact is not indicated. This poses a critical risk to affected systems running vulnerable versions of the WP OAuth Server plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to the affected plugin to mitigate risk. Monitor official miniOrange communications for updates and apply any official patches promptly once released.