vulnerability / NVI-00003471 / Revision 1

Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

OSV carries this publisher advisory for auth0/wordpress. This is an aggregated source copy; consult the original publisher and compare update dates.

source listedactiveGHSA-2f4r-34m4-3w8q

This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.

01 / Meaning

Why it matters

Published affected context helps an owner decide what evidence to gather. This report has not examined your application.

02 / Applicability

The affected context

Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.

auth0/wordpress

source listed

ECOSYSTEM: introduced 0; fixed 5.3.0

**Overview** Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. **Am I Affected?** You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using the Auth0 WordPress Plugin with version <=5.2.1 2. Auth0 WordPress Plugin uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0. 3. Session storage configured with CookieStore. **Fix** Upgrade Auth0/wordpress plugin to v5.3.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. **Acknowledgement** Okta would like to thank Félix Charette for discovering this vulnerability.

GitHub Advisory Database via OSV

03 / Response

What to do next

vendor patch
The original advisory lists fixed boundaries 5.3.0 for auth0/wordpress. Confirm the publisher’s latest guidance.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database via OSV

A fixed release is not deployment evidence.

Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.

04 / Limits

What this report cannot establish

Customer inventory, deployment, reachability and exploitation have not been inspected.

Read the collection and interpretation limits ↗

05 / Provenance

Sources you can inspect

Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.

GHSA-2f4r-34m4-3w8q ↗
GitHub Advisory Database via OSV · vendor advisory
Observed Oct 31, 2026. GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.

Public revision history

Only published revisions appear here. Routine fetches do not create a material-change event.

Revision 1 · Oct 31, 2026
First indexed by Null; source disclosure date is shown separately.

Read the public revision data ↗