External risk intelligence

WP OAuth Server SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-65520

The vulnerability affects an OAuth server plugin for WordPress. OAuth servers are designed to be public-facing endpoints to handle authentication requests and token exchanges for external clients and users, making them internet-accessible by design in typical deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the WP OAuth Server plugin, allowing unauthenticated attackers to inject SQL commands. This could potentially impact systems that rely on this plugin for authentication and authorization, making it important to understand its relevance to our environment.

SQL injection allows unauthorized data access.
It affects external-facing authentication systems.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the affected component. This could allow them to inject malicious SQL code, potentially leading to unauthorized data access or manipulation.

No authentication required to trigger.
SQL injection in OAuth server component.
Sensitive data disclosure or modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject SQL code into the WP OAuth Server plugin. This could potentially lead to unauthorized access or modification of the underlying database, impacting service availability and the integrity of stored information.

Database integrity and availability.
Network-based injection by unauthenticated users.
Potential service disruption and data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This unauthenticated SQL injection vulnerability in WP OAuth Server could allow attackers to access sensitive data. The primary responsibility for addressing this likely falls to the application owner or the platform team managing the WordPress instance. The first practical step is to identify all deployments of the affected plugin, confirm its exposure to the internet, and then assess the business criticality of each instance to prioritize remediation efforts.

Application owners or platform teams own this.
Verify plugin exposure and reachability first.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP OAuth Server plugin?

WP OAuth Server is a WordPress plugin that enables the site to act as an OAuth 2.0 authorization server. It is primarily used to manage secure authentication, allowing users or external applications to exchange tokens for access to resources or to sign in across different connected services.

What does SQL injection mean for CVE-2026-65520?

This CVE involves CWE-89, or SQL Injection. It occurs when software fails to properly sanitize input before using it in a database query. In this case, it allows an attacker to manipulate those queries to view or potentially modify information held within the site's database, bypassing the application's intended logic.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted network requests to the plugin. Because it is an unauthenticated flaw, they do not need a login or valid user credentials to interact with the vulnerable component. Simply performing routine site navigation or viewing legitimate pages will not trigger this vulnerability.

Is my instance affected according to Halo Surface Signal?

Halo Surface Signal indicates that because WP OAuth Server is designed to handle external authentication requests, its endpoints are typically reachable over the internet by design. If your plugin is active and internet-facing, it falls into the category of systems that are highly likely to be accessible to an attacker.

What should I do first to manage this risk?

Start by auditing your WordPress environment to locate every instance where this plugin is installed. Once you have a complete inventory, verify which instances are accessible to the public internet and evaluate the sensitivity of the data they process. This helps you prioritize which servers require immediate attention or updates.

References

patchstack.com/database/wordpress/plugin/miniorange-oauth-20-server/…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.