GHSA-vvg7-8rmq-92g7 Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency
Improper audience validation in Auth0 WordPress plugin allows accepting ID tokens as Access tokens, bypassing authentication checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-vvg7-8rmq-92g7?
GHSA-vvg7-8rmq-92g7 is an authentication bypass vulnerability in auth0/wordpress, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.
Affected product and versions
Projects are affected if they meet the following preconditions:
- Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.4.0,
- Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.
Resolution
Upgrade Auth0 Wordpress plugin to version 5.5.0 or greater.
Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.
Which versions are affected by GHSA-vvg7-8rmq-92g7?
2 open source packages ship an affected version, including auth0/wordpress.
| Package | Affected | Fixed in |
|---|---|---|
auth0/wordpress Packagist | From 5.0.0-BETA0 | 5.5.0 |
auth0/wordpress Packagist | From 5.0.0-BETA0 | 5.5.0 |
How do I fix GHSA-vvg7-8rmq-92g7?
Upgrade auth0/wordpress to 5.5.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-vvg7-8rmq-92g7 being exploited?
There is no known exploitation of GHSA-vvg7-8rmq-92g7 in the wild and no public exploit code.