CVE-2022-34149: 
WordPress vulnerability analysis and mitigation

CVE-2022-34149 is an Authentication Bypass vulnerability affecting the miniOrange WP OAuth Server WordPress plugin versions 3.0.4 and below. The vulnerability was discovered on June 12, 2022, and publicly disclosed on June 20, 2022. The issue has been assigned a CVSS v3.1 score of 9.8 (Critical) (Patchstack).

The vulnerability exists due to improper implementation of authentication mechanisms in the plugin. The mogetloggeduserfromauthcookie() function uses wpparseauthcookie() without proper validation of the returned values. The function processes authentication cookie components directly from client-provided cookie values without validation, allowing attackers to bypass authentication by only knowing a user's username (Lana Report).

The vulnerability allows attackers to bypass authentication by manipulating the WordPress login cookie. Depending on the username used in the exploit, attackers could potentially gain administrative access to the client's website. The severity is considered critical due to the potential for unauthorized access and complete system compromise (WPScan).

The vulnerability has been fixed in version 4.0.1 of the miniOrange WP OAuth Server plugin. Users are strongly advised to update to this version or later to remediate the security issue (Patchstack).