Known vulnerabilities in WP OAuth Server (OAuth Authentication)

Adds Authentication through OAuth 2. Provides the ability for Single Sign On for websites & Mobile Applications.

3Reported vulnerabilities

9.8Highest CVSS score

4.5.1Latest version

3,000+Active installs

What to do now

Update WP OAuth Server (OAuth Authentication) to 4.4.0 or later. 3 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 14, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2015-9435	Critical 9.8	2.1%	Before 3.1.5	`3.1.5`	September 26, 2019
CVE-2024-31253	Medium 5.4	0.4%	4.3.3 and earlier	`4.4.0`	April 5, 2024
WF-9fdc9d20-a1cf-4a58-b250-4f3f56b77b69	Medium 5.4	—	4.2.5 and earlier	`4.3.0`	January 26, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.