Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption
### Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
### Am I Affected?
Consumers are affected if their application meets the following preconditions:
- It is using the Auth0 WordPress Plugin, versions between 5.0.0-BETA0 and 5.5.0
- Auth0 WordPress plugin using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.
### Resolution
Upgrade Auth0/wordpress to version 5.6.0 or greater.
Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency
### Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.
### Affected product and versions
Projects are affected if they meet the following preconditions:
- Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.4.0,
- Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.
### Resolution
Upgrade Auth0 Wordpress plugin to version 5.5.0 or greater.
### Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their di
Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data
**Overview**
The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
**Am I Affected?**
You are affected by this vulnerability if you meet the following preconditions:
1. Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1.
2. Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.
**Fix**
Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).
Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
**Overview**
Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
**Am I Affected?**
You are affected by this vulnerability if you meet the following pre-conditions:
1. Applications using the Auth0 WordPress Plugin with version <=5.2.1
2. Auth0 WordPress Plugin uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.
**Fix**
Upgrade Auth0/wordpress plugin to v5.3.0. As an additional precautionary measure, we recommend rotating your cookie encr
Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
The Login by Auth0 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wle’ parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.