Every CVESearch/Get API key

GHSA-862m-5253-832r

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

9.3 CriticalFix available

Overview The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

  1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1.
  2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

What each source reports

GitHub Advisories Score used9.3

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

Overview The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

  1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1.
  2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).

Record
GHSA-862m-5253-832r
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-502
Updated
2026-11-02
OSV9.3

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

Overview The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

  1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1.
  2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).

Record
GHSA-862m-5253-832r
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-502
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
auth0/wordpress
Packagist
5.0.0-BETA0 to 5.0.1
5.1.0
auth0/wordpress
Packagist
5.0.0-BETA0 up to 5.1.0, plus listed versions
5.0.05.0.0-BETA15.0.1
5.1.0

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-862m-5253-832r is a critical vulnerability (CVSS 9.3) in auth0/wordpress, published June 5, 2025. No source lists public exploit code. Fixed in auth0/wordpress 5.1.0.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open