GHSA-862m-5253-832r — Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

The advisory, in context

Overview The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1.
Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

auth0/wordpress Packagist

Ecosystem versions

From 5.0.0-BETA0 before 5.1.0

Fixed in 5.1.0

4 explicitly affected versions

5.0.0, 5.0.0-BETA0, 5.0.0-BETA1, 5.0.1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.0.0-BETA0"
        },
        {
          "fixed": "5.1.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.0.0",
    "5.0.0-BETA0",
    "5.0.0-BETA1",
    "5.0.1"
  ]
}

Set up in your agent.

Investigate in your agent.

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

The advisory, in context

Affected packages

References