GitHub Advisoryadvisory · Packagist

GHSA-862m-5253-832r Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

CRITICAL Published 2025-06-05 Modified 2025-06-05 Official page ↗
Ecosystem
Packagist
Packages
auth0/wordpress
Severity
Critical
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Weaknesses
CWE-502
Reviewed
2025-06-05

Affected packages

• Packagist auth0/wordpress: >= 5.0.0-BETA0, < 5.1.0 → fixed in 5.1.0

Description

Overview The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1. 2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0. Fix Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References