Read the docs
TI-2023-01034 Aliases CVE-2023-1092GHSA-pcjh-54m8-fqfm

OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

Priority MEDIUM 62Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00442 38th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by the CNA and NVD
Fix Fixed OAuth Single Sign On Free (MiniOrange): 6.24.2OAuth Single Sign On Standard (MiniOrange): 28.4.9+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
miniOrangeOAuth Single Sign On Freebefore 6.24.26.24.2Patch availableCNA
miniOrangeOAuth Single Sign On Standardbefore 28.4.928.4.9Patch availableCNA
miniOrangeOAuth Single Sign On Premiumbefore 38.4.938.4.9Patch availableCNA
miniOrangeOAuth Single Sign On Enterprisebefore 48.4.948.4.9Patch availableCNA
  • OAuth Single Sign On Free VendorminiOrange Affected before 6.24.2 Fixed in 6.24.2 Patch available CNA
  • OAuth Single Sign On Standard VendorminiOrange Affected before 28.4.9 Fixed in 28.4.9 Patch available CNA
  • OAuth Single Sign On Premium VendorminiOrange Affected before 38.4.9 Fixed in 38.4.9 Patch available CNA
  • OAuth Single Sign On Enterprise VendorminiOrange Affected before 48.4.9 Fixed in 48.4.9 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:free:wordpress:*:*before 6.24.2VulnerableminiOrange
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:standard:wordpress:*:*before 28.4.9VulnerableminiOrange
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:premium:wordpress:*:*before 38.4.9VulnerableminiOrange
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:enterprise:wordpress:*:*before 48.4.9VulnerableminiOrange
  • cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:free:wordpress:*:* Versions before 6.24.2 Vulnerable ·miniOrange
  • cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:standard:wordpress:*:* Versions before 28.4.9 Vulnerable ·miniOrange
  • cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:premium:wordpress:*:* Versions before 38.4.9 Vulnerable ·miniOrange
  • cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:enterprise:wordpress:*:* Versions before 48.4.9 Vulnerable ·miniOrange

Remediation

  • Fix · CNA OAuth Single Sign On Free (MiniOrange) Fixed in 6.24.2
  • Fix · CNA OAuth Single Sign On Standard (MiniOrange) Fixed in 28.4.9
  • Fix · CNA OAuth Single Sign On Premium (MiniOrange) Fixed in 38.4.9
  • Fix · CNA OAuth Single Sign On Enterprise (MiniOrange) Fixed in 48.4.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1092
  2. 2026-10-03 Alias added: GHSA-pcjh-54m8-fqfm

References

Exploit 4

  • TI-2022-15071 WordPress OAuth Single Sign On – SSO (OAuth Client) Plugin <= 6.23.3 is vulnerable to Broken Authentication CVSS 3.1HIGH 8.8
  • TI-2023-01035 OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF CVSS 3.1MEDIUM 6.5
  • TI-2022-01974 OAuth Single Sign On < 6.22.6 - Authentication Bypass CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences