HIGH8.2
GHSA-vfpx-q664-h93m
Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption
Quick fix
GHSA-vfpx-q664-h93m — auth0/wordpress: upgrade to the fixed version with the command below.
composer require auth0/wordpress:^5.6.0Details
### Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
### Am I Affected? Consumers are affected if their application meets the following preconditions: - It is using the Auth0 WordPress Plugin, versions between 5.0.0-BETA0 and 5.5.0 - Auth0 WordPress plugin using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.
### Resolution Upgrade Auth0/wordpress to version 5.6.0 or greater.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/auth0/wordpress
Introduced in:
5.0.0-BETA0Fixed in: 5.6.0Fix
composer require auth0/wordpress:^5.6.0