CVE-2022-34149: 
WordPress vulnerability analysis and mitigation

CVE-2022-34149 is an Authentication Bypass vulnerability affecting the miniOrange WP OAuth Server WordPress plugin versions 3.0.4 and below. The vulnerability was discovered on June 12, 2022, and publicly disclosed on June 20, 2022. The issue has been assigned a CVSS v3.1 score of 9.8 (Critical) (Patchstack).

The vulnerability exists due to improper implementation of authentication mechanisms in the plugin. The _mo_get_logged_user_from_auth_cookie() function uses wp_parse_auth_cookie() without proper validation of the returned values. The function processes authentication cookie components directly from client-provided cookie values without validation, allowing attackers to bypass authentication by only knowing a user's username (Lana Report).

The vulnerability allows attackers to bypass authentication by manipulating the WordPress login cookie. Depending on the username used in the exploit, attackers could potentially gain administrative access to the client's website. The severity is considered critical due to the potential for unauthorized access and complete system compromise (WPScan).

The vulnerability is easily exploitable and requires no authentication. An attacker only needs to know a target username, which is often publicly available information. The exploit can be executed through browser manipulation by setting specific cookie values, and proof-of-concept code has been publicly documented (Lana Report).

The vulnerability has been fixed in version 4.0.1 of the miniOrange WP OAuth Server plugin. Users are strongly advised to update to this version or later to remediate the security issue (Patchstack).