A critical information exposure vulnerability in the WP OAuth Server plugin allows unauthenticated attackers to exfiltrate sensitive authentication tokens and user credentials.

The plugin suffers from an information exposure flaw (CWE-200) where debug logs are written to a predictable, publicly accessible location without access controls. This allows any unauthenticated attacker to retrieve OAuth tokens, authorization codes, and user password hashes if debug logging is enabled.

The exposure of OAuth tokens and password hashes presents a severe risk of account takeover and unauthorized access to protected resources. With a CVSS score of 7.5, this high-severity vulnerability could lead to widespread data breaches and loss of user privacy, potentially resulting in significant reputational damage and regulatory non-compliance for the organization.

Immediate Action: Update the WP OAuth Server plugin to version 6.3.1 or higher immediately to apply the necessary access restrictions. If an update cannot be performed, ensure that debug logging is disabled in the plugin settings.

Proactive Monitoring: Review web server access logs for requests targeting known debug log file paths or unexpected attempts to access plugin-specific directories. Monitor authentication logs for suspicious login patterns following the exposure window.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block direct public access to files with common debug log naming conventions within the WordPress plugin directory.

Public Exploit Available: Unknown

Organizations utilizing this plugin must prioritize patching to version 6.3.1 to close this critical information leakage vector. Given the ease of access for unauthenticated attackers, failure to update or disable logging exposes the entire user base to credential theft and session hijacking. Immediate remediation is required to maintain the integrity and security of the authentication flow.