CVE-2026-19715

Name of the Vulnerable Software and Affected Versions WP OAuth Server ( Login with WordPress ) versions prior to 6.3.1

Description When debug logging is enabled, the plugin fails to restrict access to its debug log. Because the log is stored at a fixed and publicly reachable location, unauthenticated users can read sensitive information, including issued OAuth tokens, authorization codes, and user records containing password hashes.

Recommendations Update to version 6.3.1 or later. As a temporary mitigation, disable debug logging to prevent the creation of the publicly accessible log file.