Security Resilience

CVE-2023-1092

Miniorange Oauth Single Sign On ≤ 6.24.2

Public PoC
Published
27 March 2023
Modified
19 February 2025
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score 0.0044 37th percentile
Risk Priority 50 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-1092 is a medium-severity an unspecified weakness vulnerability in Miniorange Oauth Single Sign On. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not…

more

have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

CWE(s)
None listed

Related Threats

CVEs Like This One

CVE-2023-1093Same product: Miniorange Oauth Single Sign On
CVE-2024-0681Same vendor: Miniorange
CVE-2024-13301Same vendor: Miniorange
CVE-2026-3217Same vendor: Miniorange
CVE-2023-0812Same vendor: Miniorange
CVE-2025-47709Same vendor: Miniorange
CVE-2024-9862Same vendor: Miniorange
CVE-2023-4757Same vendor: Miniorange
CVE-2025-6675Same vendor: Miniorange
CVE-2025-47706Same vendor: Miniorange

Affected Assets

miniorange
oauth single sign on
≤ 6.24.2 · ≤ 28.4.9 · ≤ 38.4.9

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References