Unknown WP OAuth Server ( Login with WordPress )

• CVE-2026-82843 Critical 9.0 WP OAuth Server < 6.4.0 - Subscriber+ Cross-User Account Takeover via OIDC ID Token Substitution 0.2%
• CVE-2026-19715 High 7.5 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File 0.4%