Skip to content
PluginCanary

WP OAuth Server (OAuth Authentication)

by Jayson T Cote · 3,000+ active installs · Checked 3 Nov 2026
Healthy1 Warning

Healthy: maintained, last release 24 Sep 2026, 3 releases in 24 months, no unpatched vulnerabilities.

Tested up to WordPress 6.9.0, 2 major versions behind 7.1.4.

86/ 100 Canary Score
Sub-scores for WP OAuth Server (OAuth Authentication)
Ownership100
Maintenance85
Security95
Support70
Reputation70

How the score works

Quick answers

Is WP OAuth Server (OAuth Authentication) still maintained?
Yes. Last release 24 Sep 2026, 3 releases in the last 24 months. 24 Sep 2026 · wordpress.org
Who owns WP OAuth Server (OAuth Authentication), and has it changed hands?
No change recorded. Main committer justingreerbbi since Jan 2015. 3 Nov 2026 · SVN log
Was WP OAuth Server (OAuth Authentication) removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WP OAuth Server (OAuth Authentication) safe?
8 known vulnerabilities, all fixed (latest in 4.5.2). Not on the exploited list. 30 Sep 2026 · Wordfence Intelligence
Is the latest WP OAuth Server (OAuth Authentication) update safe to install?
No ownership change before 4.5.2. No one-star spike after it. 24 Sep 2026 · Release history

Active signals

Facts we detected, with links to the source.

  • WarningMNT-2Tested up to WordPress 6.9.0, 2 major versions behind 7.1.4. Plan a replacement if the plugin is important to your site.3 Nov 2026Evidence

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
justingreerbbi15 Jan 2015 to 24 Sep 2026, 203 commits
askjayson19 Jul 2023 to 19 Jul 2023, 1 commits

2 committers recorded. No ownership change since 2013.

Maintenance

Last release
41 days ago
Releases, 24 months
3
Tested up to
6.9 vs 7.1
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP OAuth Server (OAuth Authentication)
Q1 20242
Q2 20240
Q3 20240
Q4 20240
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20261
Q2 20260
Q3 20262
Q4 20260

Last release 24 Sep 2026. Tested up to 6.9, 2 major versions behind WordPress 7.1.

Reputation

Last 90 days: no reviews. Lifetime: 3.8.

Rating distribution
5 star25
4 star3
3 star2
2 star1
1 star10

Security record

1 vulnerability in 24 months (8 on record), patched (latest fixed in 4.5.2).

Show 8 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
30 Sep 2026WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 4.5.14.5.2Patched before disclosure
5 Apr 2024OAuth Server <= 4.3.3 - Open Redirect5.4<= 4.3.34.4.0Patched before disclosure
21 Feb 2023WP OAuth Server <= 4.2.5 - Authenticated (Subscriber+) Arbitrary Client Deletion (wo_ajax_remove_client)4.3<= 4.2.54.3.0Patched before disclosure
21 Feb 2023WP OAuth Server <= 4.2.3 - Cross-Site Request Forgery to Arbitrary Post Deletion (wo_ajax_remove_client)6.5<= 4.2.34.2.5Patched before disclosure
26 Jan 2023WP OAuth Server (OAuth Authentication) <= 4.2.5 -Cross-Site Request Forgery5.4<= 4.2.54.3.09
10 Nov 2022WP OAuth Server (OAuth Authentication) <= 4.2.5 - Cross-Site Request Forgery8.8<= 4.2.54.3.086
8 Nov 2022WP OAuth Server (OAuth Authentication) <= 4.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting5.5<= 4.2.14.2.2Patched before disclosure
12 Aug 2015WP OAuth Server (OAuth Authentication) < 3.1.5 - Pseudorandom Number Generation9.8< 3.1.53.1.5247

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 2 support threads resolved in the last 2 months.

Momentum

3,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP OAuth Server (OAuth Authentication)
4 May 2026148
11 May 2026331
18 May 2026293
25 May 2026316
1 Jun 2026244
8 Jun 2026343
15 Jun 2026321
22 Jun 2026373
29 Jun 2026259
6 Jul 2026264
13 Jul 2026352
20 Jul 2026666
27 Jul 2026400
3 Aug 2026466
10 Aug 20261,436
17 Aug 20261,176
24 Aug 2026861
31 Aug 2026955
7 Sep 2026710
14 Sep 2026973
21 Sep 20261,820
28 Sep 20261,102
5 Oct 2026914
12 Oct 2026749
19 Oct 2026827
26 Oct 2026748
2 Nov 2026218

Weekly downloads over the last 4 weeks are 1% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

No healthier plugin in the same category yet.

Facts

Version4.5.2
AuthorJayson T Cote
Added21 Mar 2013
Last updated24 Sep 2026
Active installs3,000+
Requires WordPress4.7.2
Tested up to6.9.0
Requires PHP7.4
CategoryUser Management & Authentication > User Registration & Login
Tagsoauth, oauth2, Provider, OAuth provider, OAuth2 Service

Questions

Is WP OAuth Server (OAuth Authentication) still maintained?

Yes. Last release 24 Sep 2026, 3 releases in the last 24 months.

Who owns WP OAuth Server (OAuth Authentication), and has it changed hands?

No change recorded. Main committer justingreerbbi since Jan 2015.

Was WP OAuth Server (OAuth Authentication) removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WP OAuth Server (OAuth Authentication) safe?

8 known vulnerabilities, all fixed (latest in 4.5.2). Not on the exploited list.

Is the latest WP OAuth Server (OAuth Authentication) update safe to install?

No ownership change before 4.5.2. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue