WP OAuth Server (OAuth Authentication)

How well this listing is tuned to rank in WordPress.org search, on the factors an owner controls. Not popularity, optimization.

Directory searches this plugin turns up in, and which way each one is moving. WordPress.org publishes no history of search positions, so this starts the day we first tracked a keyword and never backfills.

wp.org is where the directory puts the plugin for that search. On merit is where it would sit if results were ranked on rating, support and updates, without the install boost. The last column is how far the wp.org position moved, from our first reading in the last 90 days to the latest.

56 searches this plugin appeared in over the last 90 days, 20 listed. 36 left out as unrelated or noise (years, numbers, stray words).

Directory rank vs rivals

wp.org popularity rank over time · higher is better · when a rival's line climbs above yours, they've overtaken you

How often this plugin actually ships. A steady rhythm is the maintenance signal a single "last updated" date can't show.

Share of active installs on each version of this plugin · 55% run the current release. Green is the current release; a big slice on older versions is a user base that has stopped updating.

Crossed into this band 3.3 years ago; a band this size takes about a year or more to cross, which places it about 50% of the way through.

1. ★★★★★ Jonathan Afranio

   1.2y ago

   I tested WP OAuth Server (OAuth Authentication) in integration with a client application and found a serious issue: even after the user logs out from WordPress, the issued access token is still accepted by the /oauth/me endpoint, returning all user data. This means any client application that has stored the token can continue accessing private information indefinitely, until the token expires, without verifying if the session on the server has ended. I tried to work around the issue by enabling the introspection endpoint and validating the token on each request, but the plugin does not revoke the token on logout, making introspection ineffective for detecting logouts. This flaw breaks a basic security principle of OAuth 2.0 and may expose sensitive data. I do not recommend using this plugin until token revocation upon logout is implemented.

   Read on wp.org ↗
2. ★★★★★ Vic

   2.5y ago

   It looks like the plugin is abandoned. Moreover, I bought a Pro version but it doesn’t work and nobody replies via the support email. I can’t even access my license key because the password restore doesn’t work on their website. DO NOT use this plugin!

   Read on wp.org ↗
3. ★★★★★ Northern Beaches Websites

   3.2y ago

   I just want to say thank you to the developer, you have done a great job and saved me a tonne of time 🙂

   Read on wp.org ↗
4. ★★★★★ robegb

   3.4y ago

   Just what I expected, thanks!

   Read on wp.org ↗
5. ★★★★★ uusr

   3.5y ago

   Gives an error while logging in “Missing required parameter: scope”

   Read on wp.org ↗
6. ★★★★★ ntalam

   3.5y ago

   Fatal error: Uncaught TypeError: openssl_pkey_get_details(): Argument #1 ($key) must be of type OpenSSLAsymmetricKey, null given in F:\xampp2\htdocs\wp\wp-content\plugins\oauth2-provider\includes\functions.php:388 Stack trace: #0 …\functions.php(388): openssl_pkey_get_details(NULL) #1 This topic was modified 3 years, 2 months ago by ntalam.

   Read on wp.org ↗
7. ★★★★★ Ivan Hryhorenko

   4.1y ago

   There is no answer even on the premium version website. The plugin is abandoned, with legacy code and some bugs. Please, choose an alternative decision. Didn’t use this one! This topic was modified 3 years, 10 months ago by Ivan Hryhorenko.

   Read on wp.org ↗
8. ★★★★★ sunmp12

   4.4y ago

   There are a lot of bugs and strange or malfunctioning in the plugin. Looking at the plugin forum, there is no support for the plugin at all. Maybe there is only support for the pro version, but so I don’t dare try it.

   Read on wp.org ↗

Recent releases and news for this plugin

1. — Version 4.5.0 Security Update: A patch has been added to protect the private key during certain server configurations. Updating is highly recommended. Added a new admin notice for permalink setting recommendations. Updated with WP 6.9 4.5.0
2. — Version 4.4.0 (Security Update) Refactored the “destroy” endpoint to remove the auto redirect in favor for a manual checkpoint. Cleaned up misc functions. This should not effect any existing implementations. Tested with 6.4 installed. 4.4.0
3. — Version 4.3.4 Updated to fix deprecated messages for PHP 8.1 and WP 6.2 Added prepare statements in CRON cleanup Adjustments to make some options more clear. 4.3.4
4. — Version 4.3.3 Updated wpoauth_authenicate_bypass to return false. Tested with WP 6.2 4.3.3
5. — Version 4.2.5 Updated sanity checks in AJAX 4.2.5
6. — Version 4.2.3 Tested WP 6.0.3 4.2.3

All 8 disclosed vulnerabilities are patched in the current version (4.5.2). Sites still on an older version should update.

1. Patched Medium · 6.4 WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting ↗
   2026-09-30 CVE-2026-97288 Improper Neutralization of Input During Web Page Generation Affects <= 4.5.1 Patched in 4.5.2
2. Patched Medium · 5.4 OAuth Server <= 4.3.3 - Open Redirect ↗
   2024-04-05 CVE-2024-31253 URL Redirection to Untrusted Site Affects <= 4.3.3 Patched in 4.4.0
3. Patched Medium · 4.3 WP OAuth Server <= 4.2.5 - Authenticated (Subscriber+) Arbitrary Client Deletion (wo_ajax_remove_client) ↗
   2023-02-21 CVE-2022-4148 Incorrect Authorization Affects <= 4.2.5 Patched in 4.3.0
4. Patched Medium · 6.5 WP OAuth Server <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Post Deletion (wo_ajax_remove_client) ↗
   2023-02-21 CVE-2022-3894 Cross-Site Request Forgery Affects <= 4.2.3 Patched in 4.2.5
5. Patched Medium · 5.4 WP OAuth Server (OAuth Authentication) <= 4.2.5 -Cross-Site Request Forgery ↗
   2023-01-26 Cross-Site Request Forgery Affects <= 4.2.5 Patched in 4.3.0
6. Patched High · 8.8 WP OAuth Server (OAuth Authentication) <= 4.2.5 - Cross-Site Request Forgery ↗
   2022-11-10 CVE-2022-3926 Cross-Site Request Forgery Affects <= 4.2.5 Patched in 4.3.0
7. Patched Medium · 5.5 WP OAuth Server (OAuth Authentication) <= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting ↗
   2022-11-08 CVE-2022-3892 Improper Neutralization of Input During Web Page Generation Affects <= 4.2.1 Patched in 4.2.2
8. Patched Critical · 9.8 WP OAuth Server (OAuth Authentication) < 3.1.5 - Pseudorandom Number Generation ↗
   2015-08-12 CVE-2015-9435 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Affects < 3.1.5 Patched in 3.1.5

Automated install-time checks, tested on PHP 8.1.12 · WP 7.0.1

Translated into 5 languages, 0 at 90% or more

Whether ChatGPT and Claude name this plugin when asked the category question, and whether the readme gives them something to quote.

Not measured yet for this plugin’s topics. Its tracked searches are not among the measured topics. See the topics measured so far.

Growth timeline

Install-tier crossings we have observed, and how long each tier took to outgrow

1. 2023-07-14 4K+ → 3K+ down after 2 days in tier
2. 2023-07-12 3K+ → 4K+ up after 1 days in tier
3. 2023-07-11 4K+ → 3K+ down after 486 days in tier
4. 2022-03-12 3K+ → 4K+ up after 65 days in tier
5. 2022-01-06 4K+ → 3K+ down after 36 days in tier
6. 2021-12-01 3K+ → 4K+ up after 301 days in tier
7. 2021-02-03 2K+ → 3K+ up after 685 days in tier
8. 2019-03-21 1K+ → 2K+ up after 1088 days in tier

Competes with

The plugins that solve the same job, ranked by shared tags then reach, closest match first. The letter on the right is each plugin's health grade (A best, F worst).

Embed this report card

Drop a live Pulse card for WP OAuth Server (OAuth Authentication) into a readme, a review or a deck. It updates itself.

WP OAuth Server (OAuth Authentication): 3K+ active installs, 3.8★ (41 reviews). Plugin Pulse (WP Mayor), as of 2026-11-01. https://plugins.wpmayor.com/plugin/oauth2-provider