Read the docs
TI-2026-85151 Aliases CVE-2026-122220GHSA-72vv-ff63-gjjc

Authentication bypass via SAML replay in WPO365 LOGIN plugin

Priority MEDIUM 41CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

The WPO365 | LOGIN (wpo365-login) plugin for WordPress before version 45.2 contains an authentication bypass by capture-replay (CWE-294). Its anti-replay check for SAML message IDs never saves processed IDs, so a validly signed SAMLResponse can be replayed to the ACS endpoint repeatedly within its assertion validity window. An attacker who captures such a response can log in as the victim, including administrators, without detection.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Fixed WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (wpo365): 45.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wpo365WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)before 45.245.2Patch availableCNA
  • WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) Vendorwpo365 Affected before 45.2 Fixed in 45.2 Patch available CNA

Remediation

Update the WPO365 | LOGIN (wpo365-login) plugin to version 45.2 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (wpo365) Fixed in 45.2

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-122220
  2. 2026-11-04 Alias added: GHSA-72vv-ff63-gjjc
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: MEDIUM → LOW
  5. 2026-11-06 Priority changed: LOW → MEDIUM

References

Patch 1

Other 1

  • TI-2021-19351 WPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scripting CVSS 3.1CRITICAL 9.3
  • TI-2026-12809 Cross-site request forgery in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION CVSS 3.1HIGH 8.8
  • TI-2026-70259 Authentication bypass in WPO365 WordPress plugin via OIDC nonce replay CVSS 3.1HIGH 8.1
  • TI-2020-16157 The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to… CVSS 3.1HIGH 7.5
  • TI-2026-70212 Stored cross-site scripting in WPO365 Login WordPress plugin CVSS 3.1HIGH 7.2
  • TI-2026-83509 Stored cross-site scripting in WPO365 Microsoft 365 Graph Mailer CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences