Improper Audience Validation in Auth0 WordPress Plugin - Security Risk Identified
Summary
GHSA-vvg7-8rmq-92g7: Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency. Affects auth0/wordpress versions >= 5.0.0-BETA0, < 5.5.0. Fixed in 5.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Auth0 WordPress plugin enables developers to integrate Auth0 authentication into their WordPress applications seamlessly. It leverages the Auth0-PHP SDK to manage user authentication and authorization. However, certain versions of this plugin are vulnerable to improper audience validation, which can lead to security risks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from the improper validation of audience claims in access tokens when using the Auth0-PHP SDK. This flaw allows affected applications to mistakenly accept ID tokens as access tokens, potentially leading to unauthorized access. The issue is particularly critical for applications that rely on token validation for securing user data and functionalities.
How To Fix
Minimum fixed version
5.5.0
This is the first release that contains the fix.
composer require auth0/wordpress:5.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, the Auth0 WordPress plugin has a significant vulnerability related to improper audience validation due to its dependency on the Auth0-PHP SDK. It is crucial for users of affected versions to upgrade to version 5.5.0 or higher to mitigate potential security risks.
See every vulnerability recorded for auth0/wordpress →
FAQ
Versions between 5.0.0-BETA0 and 5.4.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow unauthorized users to gain access to sensitive information and functionalities within the application.
The vulnerability was discovered and responsibly disclosed by Jafar Sadiq (iaf4r).
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/wordpress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
