IT SBIT Services
Schneeberger
DEEN
CVE tracker

WPO365 Login WordPress plugin: Authentication bypass via OIDC id_token nonce replay

CVE-2026-104759High 8.1

← All vulnerabilities

Summary

The WPO365 | Login plugin for WordPress, which connects WordPress with Microsoft identity services, is affected up to and including version 44.1. An unauthenticated attacker who has obtained a previously issued, still valid id_token for a target account can replay it and log in as any WordPress user, including administrators, which can lead to full site takeover. The flaw is only reachable when the non-default option use_id_token_parser_v2 is enabled.

Affected

  • WPO365 | Login (WordPress plugin) versions 0 to and including 44.1
  • Only exploitable if the option use_id_token_parser_v2 is enabled
  • Default setting of the option: Unknown.

Fixed in

  • Fixed in version 45.0 (per the 44.1 to 45.0 changeset)
  • The current release listed on wordpress.org is 45.1

Workaround

  • Disable the option use_id_token_parser_v2 (interim measure, not a vendor recommendation; test SSO logins afterwards, as this may break SSO for some setups)
  • Update to 45.0 or later as the primary fix

Exploitation

  • CISA SSVC: Exploitation none, Automatable no, Technical Impact total
  • No evidence of exploitation in the wild found; not confirmed in CISA KEV
  • No public proof of concept found; this does not prove none exists
  • EPSS 0.00515 (third-party value)
  • Attack complexity is high (AC:H) because a valid id_token is needed

Our recommendation

  • Check whether the plugin is installed and which version is active; update to 45.0 or later
  • Until the update is done, check that use_id_token_parser_v2 is disabled and test SSO login afterwards
  • Review administrator and other privileged accounts for unexpected changes or logins
  • Review authentication logs for unusual logins, especially for administrator accounts
  • Prioritise this for internet-facing sites that use Microsoft 365 SSO with this plugin

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 20:16.

Original description (NVD)

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed