GHSA-862m-5253-832r json
Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data
published last yr. modified 9mo ago
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
**Overview** The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
**Am I Affected?** You are affected by this vulnerability if you meet the following preconditions:
1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1. 2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.
**Fix** Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).
Patch / fix
- packagist auth0/wordpress 5.1.0
Is GHSA-862m-5253-832r in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | auth0/wordpress | >=5.0.0-BETA0, <5.1.0 |
5.1.0 |
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/auth0/auth0-PHP/security/advisories/GHSA-v9m8-9xxp-q492
web
-
github.com
/auth0/laravel-auth0/security/advisories/GHSA-c42h-56wx-h85q
web
-
github.com
/auth0/symfony/security/advisories/GHSA-98j6-67v3-mw34
web
-
github.com
/auth0/wordpress/security/advisories/GHSA-862m-5253-832r
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-48951
advisory
-
github.com
/auth0/wordpress
package
Sources
- GitHub Advisory GHSA-862m-5253-832r
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.