GHSA-862m-5253-832r: Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

critical Affects auth0/wordpress. Feed 2026.10.29.1, updated 2026-10-28; published 2025-06-05; advisory modified 2026-02-04.

Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data

Package: auth0/wordpress Composer
Affected versions: >=5.0.0-BETA0 and <5.1.0
Fixed in: 5.1.0
Severity: critical
Exploitation: not on CISA KEV
Published: 2025-06-05
Source: osv.dev

References

CWE-502

NVD record auth0/wordpress advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2023-6813 medium Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting same package: auth0/wordpress
GHSA-2f4r-34m4-3w8q critical Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessio same package: auth0/wordpress
GHSA-vfpx-q664-h93m high Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption same package: auth0/wordpress
GHSA-vvg7-8rmq-92g7 medium Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency same package: auth0/wordpress
CVE-2025-49113 KEV critical Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization same weakness: CWE-502
CVE-2019-6340 KEV high Some field types do not properly sanitize data from non-form sources. This can lead to arb same weakness: CWE-502