CVE-2026-82843

CriticalCVSS 9.0/10Last modified Sep 24, 2026

Description

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.4.0 does not bind the OpenID Connect identity assertion it issues to the authorization grant being exchanged, returning instead the assertion belonging to whichever user authenticated most recently, which allows users with the Subscriber role and above to obtain a validly signed identity assertion for another user, including an administrator, and authenticate as them at any application that uses the site for single sign-on.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Sep 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-828445.3The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on fCVE-2026-828459.9The Masteriyo LMS WordPress plugin before 3.4.1 does not prevent user-supplied values held as metadata from being deserialized when they arCVE-2026-828466.8The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page availablCVE-2026-828476.8The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the courCVE-2026-828485.3The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over itCVE-2026-828494.3The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being retCVE-2026-82854.3Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. ThCVE-2026-828504.3The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a stCVE-2026-828512.7The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for downCVE-2026-828525.4Unauthenticated Server Side Request Forgery (SSRF) in MapSVG <= 8.15.0 versions.CVE-2026-828534.9Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. ThCVE-2026-828549.8Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes
CVE-2026-82843: Critical severity, CVSS 9.0 | Vulnix