Is CVE-2026-19715 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-19715 being exploited in the wild.

How severe is CVE-2026-19715?

High severity, with a CVSS score of 7.5, published 27 August 2026.

Which products and versions are affected?

miniOrange WP OAuth Server before 6.3.1.

Is there a fix for CVE-2026-19715?

A patch was published on 2026-08-25: Fixed in version 6.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-19715 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-19715?

Check whether you run miniOrange WP OAuth Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-19715: WP OAuth Server debug log information disclosure

CVE-2026-19715 · Severity: high · CVSS 7.5 · Published 2026-08-27

The WP OAuth Server WordPress plugin writes debug logs containing sensitive OAuth tokens, authorization codes, and user password hashes to a publicly accessible location without authentication. When debug logging is enabled, an attacker can read these files to obtain active credentials and impersonate users, leading to unauthorized access to user accounts and accounts linked through OAuth.

Vendors: miniOrange.

Quick answers

Is CVE-2026-19715 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-19715 being exploited in the wild.
How severe is CVE-2026-19715?: High severity, with a CVSS score of 7.5, published 27 August 2026.
Which products and versions are affected?: miniOrange WP OAuth Server before 6.3.1.
Is there a fix for CVE-2026-19715?: A patch was published on 2026-08-25: Fixed in version 6.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19715 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-19715?: Check whether you run miniOrange WP OAuth Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure issue (CWE-200) caused by insufficient access controls on debug log files. The plugin stores logs at a fixed, web-accessible path (wp-content/uploads/miniorange-oauth-20-server/error-logs/wp_oauth_server_errors.log) without authentication or authorization checks. When debug logging is enabled, these logs contain unencrypted OAuth tokens, refresh tokens, authorization codes, and full WordPress user records including password hashes. An unauthenticated attacker can directly access this file via HTTP GET and retrieve active tokens to authenticate as any user who has completed an OAuth authorization flow. The vulnerability requires debug logging to be enabled but does not require network authentication or user interaction. Versions before 6.3.1 are affected; the issue is patched in 6.3.1.

Affected products

miniOrange WP OAuth Server before 6.3.1

Timeline

2026-08-25: disclosed
2026-08-27: advisory
2026-08-25: patched: Fixed in version 6.3.1

References

https://wpscan.com/vulnerability/94987bd9-7ac2-44fd-93df-52892c2a4622/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.