Critical Brute Force Vulnerability in Auth0 WordPress Plugin
Summary
GHSA-2f4r-34m4-3w8q: Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions. Affects auth0/wordpress versions < 5.3.0. Fixed in 5.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Auth0 WordPress plugin is a widely used tool that enables developers to integrate authentication and authorization features into their WordPress applications. It leverages the Auth0-PHP SDK to provide secure login options, social logins, and user management functionalities. However, certain versions of this plugin are susceptible to a critical vulnerability that allows brute force attacks on session cookies, potentially leading to unauthorized access to user accounts.
Vulnerability Detail
The vulnerability arises from the use of CookieStore for session storage in the Auth0 WordPress plugin. Specifically, session cookies configured with authentication tags can be brute-forced, allowing attackers to gain unauthorized access to user sessions. This issue affects versions of the Auth0 WordPress plugin that are 5.2.1 or lower and utilize the Auth0-PHP SDK version 8.0.0-BETA1 through 8.14.0. The ramifications of this vulnerability are severe, as it can lead to compromised user accounts and sensitive data exposure.
How To Fix
Minimum fixed version
5.3.0
This is the first release that contains the fix.
composer require auth0/wordpress:5.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider switching the session storage from CookieStore to an alternative method that does not expose session cookies to brute force attacks. This may involve configuring your application to use a different session management strategy.
Conclusion
The Auth0 WordPress plugin has a critical vulnerability that allows for brute force attacks on session cookies, potentially leading to unauthorized access. It is essential for users of the affected versions to upgrade to version 5.3.0 or higher and consider additional security measures such as rotating cookie encryption keys. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for auth0/wordpress →
FAQ
Versions of the Auth0 WordPress plugin that are 5.2.1 or lower are affected by this vulnerability.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an immediate upgrade is not possible, consider implementing the recommended workaround by changing the session storage method.
The vulnerability was discovered by Félix Charette, and it has been acknowledged by Okta.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/wordpress.
