Exploit for OAuth Single Sign On - SSO (OAuth Client) Free < 6.24.2 - IdP Deletion via CSRF

CVE-2023-1092

wpexploit · 2023-02-28

Description

OAuth Single Sign On - SSO (OAuth Client) Free < 6.24.2 - IdP Deletion via CSR

Entry point

Parameterpage · query param

Path/wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=delete&app=wordpress

CSRF vulnerability in IdP deletion endpoint allowing logged-in admins to perform deletion without CSRF protection.

Affected Miniorange Oauth Single Sign On versions

Miniorange Oauth Single Sign On< 6.24.2, 28.4.9, 38.4.9, 48.4.9

All known vulnerabilities by product

Oauth Single Sign On Enterprise Oauth Single Sign On Free Oauth Single Sign On Premium Oauth Single Sign On Standard

CVSS 6.5 for CVE-2023-1092

6.5

MEDIUM SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:UNCHANGED

Confidentiality:NONE

Integrity:HIGH

Availability:NONE

EPSS Score

0.4%higher than 35.0% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2023-02-28 14:33

Last Seen:2023-06-25 20:41

Reporter:Nguyen Thuc Tuyen

Other exploits for CVE-2023-1092

OAuth Single Sign On - SSO (OAuth Client) Premium < 38.4.9 - IdP Deletion via CSRF

2023-02-28 Nguyen Thuc TuyenWPEXPLOIT

OAuth Single Sign On - SSO (OAuth Client) Standard < 28.4.9 - IdP Deletion via CSRF

2023-02-28 Nguyen Thuc TuyenWPEXPLOIT

OAuth Single Sign On - SSO (OAuth Client) Enterprise < 48.4.9 - IdP Deletion via CSRF

2023-02-28 Nguyen Thuc TuyenWPEXPLOIT

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:8FBF7EFE-0BF2-42C6-AEF1-7FCF2708B31B
https://example.com/wp-admin/admin.php?page=mo_oauth_settings&tab=config&action=delete&app=wordpress

Exploit Code

Share

Share on social media: