Medium severity5.3NVD Advisory· Published Jul 17, 2022· Updated Jun 17, 2026

CVE-2022-2133

Description

The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto the site with the only knowledge of a user's email address.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Miniorange/OAuth Single Sign On
cpe:2.3:a:miniorange:oauth_single_sign_on:*:*:*:*:*:wordpress:*:*
Range: <6.22.6
WordPress/OAuth Client Single Sign Oncpe-rescue
Package: https://wordpress.org/plugins/oauth-client-single-sign-on
WordPress/OAuth Single Sign Onllm-fuzzy
Range: <6.22.6

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/e76939ca-180f-4472-a26a-e0c36cfd32denvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000