---
title: "GHSA-2f4r-34m4-3w8q: Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions"
url: https://erroneo.us/security/ghsa/GHSA-2f4r-34m4-3w8q/
description: "GHSA-2f4r-34m4-3w8q (critical, Composer (PHP)): Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions. Overview…"
type: advisory
section: "Security Digest"
date_published: 2025-05-17
date_modified: 2025-05-17
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2f4r-34m4-3w8q"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2f4r-34m4-3w8q: Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

## Affected packages

- Composer (PHP) `auth0/wordpress` < 5.3.0 → fixed: 5.3.0

## Details

Overview Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using the Auth0 WordPress Plugin with version

## Sources

- [GitHub Advisory GHSA-2f4r-34m4-3w8q](https://github.com/advisories/GHSA-2f4r-34m4-3w8q)
- [github.com](https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q)
- [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-47275)
- [github.com](https://github.com/auth0/wordpress/commit/06b64468089472d8b62c881708be7eb3749b35ac)
- [github.com](https://github.com/auth0/wordpress/releases/tag/5.3.0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2f4r-34m4-3w8q/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt