CVE-2026-65520

CRITICAL

WordPress WP OAuth Server plugin <= 6.2.0 - SQL Injection vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-65520 has a selected CVSS score of 9.3 (critical); EIP currently links 1 curated repository PoC and 1 lab environment.

Description

Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.

Description source: CVE List

Exploitation context

Available material

Curated repository PoCs
1
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 6, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP OAuth Server

Browse miniOrange / WP OAuth Serverminiorange-oauth-20-server

Default status: unaffected

CVE ListThrough 6.2.0affected

Proofs of concept

1

Curated repository PoCs

GitHubCVE-2026-65520Curated repository PoCby exploitintel8Not analyzed8 files

C · 1.5 MiB

GitHub
PoC details

Docker lab environments

1
GitHub

CVE-2026-65520/docker-compose.yml

CVE-2026-65520Created Vuln labCVE-2026-65520Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for reproducing CVE-2026-65520, an unauthenticated SQL injection in the miniOrange WP OAuth Server WordPress plugin (<= 6.2.0). It uses stock WordPress and MariaDB images, mounts the vulnerable plugin zip, and includes a seed script and PoC.

CVE-2026-65520/docker-compose.yml:1-41CVE-2026-65520/README.md:1-89

Lab assessment

Vulnerability lab

The README explicitly describes a vulnerability (CVE-2026-65520), provides a PoC, and the Compose file sets up a WordPress instance with the vulnerable plugin mounted for reproduction.

CVE-2026-65520/README.md:1-3CVE-2026-65520/docker-compose.yml:24-25
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

db

database

MariaDB 10.11 service providing the WordPress database. Configured with root and user credentials, a healthcheck, and a named volume for persistence.

CVE-2026-65520/docker-compose.yml:2-14

wordpress

web applicationvulnerable target

WordPress 6.5 with PHP 8.2 and Apache. The vulnerable miniOrange OAuth Server plugin zip is bind-mounted read-only at /lab-assets/. Port mapping exposes the service on a configurable host port. Depends on the db service being healthy.

CVE-2026-65520/docker-compose.yml:16-35

seed.sh

provisioning script

Bash script that waits for WordPress readiness, installs WP-CLI if missing, performs core install, sets permalinks, installs the vulnerable plugin from the mounted zip, creates test users, configures the OAuth server plugin, registers an OAuth client and authorization code, and writes credentials to a file.

CVE-2026-65520/seed.sh:1-109

poc.py

proof-of-concept exploit

Python script that demonstrates time-based blind SQL injection against the token endpoint. It sends a JSON payload with a malicious scope parameter, confirms injection via SLEEP timing, and extracts the database version prefix using binary search.

CVE-2026-65520/poc/poc.py:1-167

miniorange-oauth-20-server.6.2.0.zip

vulnerable plugin asset

The vendored vulnerable plugin zip file, mounted into the WordPress container for installation. Its contents are uninspected.

CVE-2026-65520/docker-compose.yml:24-25CVE-2026-65520/README.md:21-23
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-65520

Supported by supplied evidence

The README, PoC script, and verification report consistently describe and demonstrate a time-based blind SQL injection in the miniOrange WP OAuth Server plugin <= 6.2.0, matching the CVE description. The PoC confirms the vulnerability via SLEEP timing and data extraction.

CVE-2026-65520/README.md:1-3CVE-2026-65520/poc/poc.py:1-5CVE-2026-65520/poc_verification_report.md:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.CVE-2026-65520/README.md:63-65
  • The WEB_PORT environment variable must be set before running docker compose and seed.sh.CVE-2026-65520/README.md:64-65
  • The vulnerable plugin zip file must be present at the expected relative path.CVE-2026-65520/docker-compose.yml:24-25
  • Valid OAuth2 client credentials and an authorization code are required for the PoC; these are created by seed.sh.CVE-2026-65520/README.md:5CVE-2026-65520/seed.sh:56-70

Evidence-described exercise path

  1. Set the WEB_PORT environment variable and start the lab with docker compose down -v && docker compose up -d.CVE-2026-65520/README.md:64-65
  2. Run seed.sh to provision WordPress, install the vulnerable plugin, and create OAuth credentials.CVE-2026-65520/README.md:67-70
  3. Execute the PoC script with the seeded credentials to confirm SQL injection and extract the database version.CVE-2026-65520/README.md:72-75
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior targets the contained lab environment. The PoC exploits the vulnerable WordPress plugin inside the container, and no evidence shows host escape, external connections, persistence, credential theft, or destructive actions beyond the intended vulnerability demonstration.

CVE-2026-65520/poc/poc.py:1-167CVE-2026-65520/seed.sh:1-109CVE-2026-65520/docker-compose.yml:1-41
Review boundaries

What the analysis did not establish

  • The vulnerable plugin zip (miniorange-oauth-20-server.6.2.0.zip) is uninspected; its contents are not analyzed.
  • The PoC script uses urllib to send HTTP requests to the target; no network behavior beyond the lab is visible, but the script's network calls are not independently verified.
  • The seed.sh script downloads wp-cli.phar from an external URL if not present; this is a provisioning step but introduces an external dependency not fully inspected.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: some source evidence omitted

References

2