CVE-2026-15212
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The WPO365 | Login plugin for WordPress up to version 43.2 is vulnerable to Cross-Site Request Forgery. The Ajax request verification can be disabled, allowing an unauthenticated attacker to overwrite arbitrary plugin options, including enabling the SCIM REST endpoint, setting a known SCIM token, and assigning administrator role to new users.
Risk Assessment
An attacker can take over the WordPress site by creating an admin account and gaining full access.
Recommendation
Update the WPO365 | Login plugin to the latest available version (above 43.2).
Other vulnerabilities in WPO365 | Login
See all- CVE-2026-122220High
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection.
- CVE-2026-104759High
The WPO365 | LOGIN plugin for WordPress is vulnerable to authentication bypass via OIDC nonce replay in all versions up to and including 44.1. This occurs when the use_id_token_parser_v2 option is enabled.
Original NVD description (English source)
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS