GHSA-w22c-pw5m-482x
Auth0 Wordpress plugin Does Not Properly Handle File Types in Bulk User Import
Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.3.0,
- Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.
Fix
Upgrade Auth0 Wordpress plugin to version 5.4.0 or greater.
Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
What each source reports
GitHub Advisories Score used
Auth0 Wordpress plugin Does Not Properly Handle File Types in Bulk User Import
Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.3.0,
- Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.
Fix
Upgrade Auth0 Wordpress plugin to version 5.4.0 or greater.
Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.
- Record
GHSA-w22c-pw5m-482x- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
auth0/wordpressPackagist | Source text: > 5.0.0-BETA0, <= 5.3.0 | 5.4.0Not evaluated |
Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-w22c-pw5m-482x is a low vulnerability (CVSS 3.3) in auth0/wordpress, published October 1, 2025. No source lists public exploit code. A source reports a fix.