CVE-2026-122220
HighCVSS 7.4Summary
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection.
Risk Assessment
An attacker can capture a valid SAMLResponse and replay it repeatedly to gain access to the victim's account, including administrator accounts, without detection. This can lead to full account takeover and privilege escalation.
Recommendation
Upgrade the WPO365 | LOGIN plugin to version 45.2 or later. Until then, monitor for unusual logins and consider limiting trust in the identity provider.
Other vulnerabilities in WPO365 | LOGIN
See all- CVE-2026-104759High
The WPO365 | LOGIN plugin for WordPress is vulnerable to authentication bypass via OIDC nonce replay in all versions up to and including 44.1. This occurs when the use_id_token_parser_v2 option is enabled.
- CVE-2026-15212High
The WPO365 | Login plugin for WordPress up to version 43.2 is vulnerable to Cross-Site Request Forgery. The Ajax request verification can be disabled, allowing an unauthenticated attacker to overwrite arbitrary plugin options, including enabling the SCIM REST endpoint, setting a known SCIM token, and assigning administrator role to new users.
Original NVD description (English source)
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS