WPO365 LOGIN: Broken Access Control in WordPress plugin
Summary
The WPO365 LOGIN plugin for WordPress, which provides Microsoft Entra ID single sign-on and Microsoft 365 integration, has a broken access control flaw (CWE-862) in versions up to and including 44.1. An attacker with a valid Subscriber-level account can reach functions or data they are not authorized to use, with a scope change and high confidentiality impact (CVSS 8.5). The risk is highest where self-registration is open or where SSO creates accounts automatically.
Affected
- WPO365 LOGIN (WordPress plugin) up to and including 44.1
- Required privilege: Subscriber
Fixed in
- Update to version 45.0 or later (per Patchstack). The current release on WordPress.org is 45.1.
- Note: the link between the WPScan 45.0 entry and this CVE is probable but not confirmed.
Workaround
- Unknown. No vendor workaround is listed; updating is the primary action.
- If updating is delayed, review Subscriber accounts and whether self-registration or automatic account creation is enabled.
Exploitation
- No known exploitation in the sources reviewed. CISA SSVC lists exploitation as none and automatable as no.
- Patchstack rates the flaw as high priority, expects exploitation and notes that mitigation rules are available.
- Public PoC: unknown.
Our recommendation
- Identify all WPO365 installations and confirm the version.
- Update to 45.1 (or at least 45.0). On Apache with the Media Folder option enabled, disable and re-enable that option after the update.
- Review Subscriber accounts and automatic account creation for Microsoft Entra SSO, and remove unneeded accounts.
- Watch for unusual logins and check NVD and Patchstack for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory patchstack.com
- WordPress.org plugin page WPO365 LOGIN wordpress.org
- HOL Guard CVE entry hol.org
- WPScan plugin entry wpscan.com
- Securityonline CVE watchtower entry securityonline.info
- WPO365 Entra ID single sign-on for WordPress www.wpo365.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:25.
Original description (NVD)
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.