CVE-2023-1092 - CVE House
Back to Database
Status published Unknown CVE-2023-1092

OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF

Vulnerability Description

The OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attack

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-1092

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Nguyen Thuc Tuyen
  • WPScan

References

Affected Vendor

Affected Software

OAuth Single Sign On Free, OAuth Single Sign On Standard, OAuth Single Sign On Premium, OAuth Single Sign On Enterprise
Vulnerable Versions:
0

Timeline

Official Publish: March 27th, 2023
Last Modified: February 19th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.