Read the docs
TI-2025-43678 Aliases GHSA-862m-5253-832r

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

Priority LOW 38CWE-502Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Code execution
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-502.

Summary

**Overview** The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. **Am I Affected?** You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1. 2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0. **Fix** Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).

Why it matters now

Fix Fixed auth0/wordpress (Packagist): 5.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—auth0/wordpress (Packagist)5.0.0-BETA0 to before 5.1.05.1.0Patch availableGHSA-862m-5253-832r
  • auth0/wordpress (Packagist) Vendor— Affected 5.0.0-BETA0 to before 5.1.0 Fixed in 5.1.0 Patch available GHSA-862m-5253-832r

Remediation

  • Fix · GHSA-862m-5253-832r auth0/wordpress (Packagist) Fixed in 5.1.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-862m-5253-832r

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences