GHSA-862m-5253-832r Auth0 Wordpress Plugin vulnerable to Deserialization of Untrusted Data
Attackers can execute arbitrary code by sending malicious serialized data in cookies to sites using the Auth0 WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-862m-5253-832r?
GHSA-862m-5253-832r is an unsafe deserialization vulnerability in auth0/wordpress, published on 5 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Overview The Auth0 Wordpress plugin contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 WordPress plugin, versions between 5.0.0 BETA-0 to 5.0.1.
- Auth0 WordPress plugin uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.
Fix Upgrade the Auth0 WordPress plugin to the latest version (v5.3.0).
Which versions are affected by GHSA-862m-5253-832r?
2 open source packages ship an affected version, including auth0/wordpress.
| Package | Affected | Fixed in |
|---|---|---|
auth0/wordpress Packagist | From 5.0.0-BETA0 | 5.1.0 |
auth0/wordpress Packagist | From 5.0.0-BETA0 | 5.1.0 |
How do I fix GHSA-862m-5253-832r?
Upgrade auth0/wordpress to 5.1.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-862m-5253-832r being exploited?
There is no known exploitation of GHSA-862m-5253-832r in the wild and no public exploit code.