Unauthorized Access to Debug Log in WP OAuth Server Plugin by WordPress
CVE-2026-19715
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19715?
The WP OAuth Server plugin for WordPress, prior to version 6.3.1, contains a flaw that allows unauthenticated users to access the debug log. This log, stored in a publicly accessible location, may contain sensitive information including OAuth tokens, authorization codes, and user records, such as password hashes. If debug logging is enabled, this vulnerability poses a significant risk, as it permits malicious actors to exploit this information without the need for authentication.
Affected Version(s)
WP OAuth Server ( Login with WordPress ) 0 < 6.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.