Security Alert Summary
The WP OAuth Server ( Login with WordPress ) plugin before 6.3.1 does not restrict access to a debug log file it writes to a fixed, publicly reachable location. When debug logging is enabled, unauthenticated users can read that log and obtain issued OAuth tokens, authorization codes, and user records including password hashes.
CVE Details
- CVE ID: CVE-2026-19715
- Affected component: WP OAuth Server ( Login with WordPress ) WordPress plugin
- Affected versions: versions less than 6.3.1
- Published: August 27, 2026 at 06:16:57 AM
- Last modified: August 27, 2026 at 06:16:57 AM
- CVSS v3.1: Not provided in the CVE data
- Authentication / privileges / user interaction: No authentication required; no privileges required; no user interaction required (unauthenticated read access to the debug log is described)
- Primary impact: Confidentiality (disclosure of OAuth tokens, authorization codes, and user records including password hashes). Integrity: not indicated. Availability: not indicated.
- CWE / weakness ID: Not specified in the CVE data
Technical Details
The plugin writes a debug log to a fixed, publicly reachable location and does not restrict access to that file. Because the file is readable without authentication, an attacker can retrieve its contents when debug logging is enabled. The log can contain issued OAuth tokens, authorization codes, and user records including password hashes.
This vulnerability exists due to insufficient access controls on the debug log output and reliance on a predictable storage location. The CVE description does not list specific function names or REST API endpoints; it specifically identifies the unrestricted debug log and the presence of sensitive data within it as the root issue.
Impact is limited to disclosure of data written to the debug log. The CVE does not claim direct code execution, privilege escalation, or service disruption originating from the log exposure itself.
How This Could Impact Your Website
Consider a small team running a WordPress site with a site owner, an internal content editor, and an external contractor who configures OAuth integrations. If debug logging is enabled, the public debug log could expose OAuth tokens and authorization codes issued for integrations, plus user records and password hashes. That exposure could allow an attacker to:
- Access or reuse OAuth tokens against third-party integrations that trust those tokens, depending on token scope and lifetime.
- Obtain user email addresses and other records that increase the risk of targeted phishing or social engineering aimed at staff or contractors.
- Download password hashes which could be subjected to offline cracking attempts; successful cracking could lead to credential misuse where passwords are reused.
These consequences do not necessarily imply full site compromise, but they materially increase account and integration risk. professional review can help determine whether your site is affected and how to assess user roles and plugin settings.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Disable debug logging in production environments and ensure debug files are not stored in publicly accessible locations.
- Review and reduce unnecessary user roles, especially contributors and other low-privilege accounts that may be targeted.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual behavior, including unexpected OAuth token usage.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
