WPO365 | LOGIN vulnerabilities

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection.

The WPO365 | LOGIN plugin for WordPress is vulnerable to authentication bypass via OIDC nonce replay in all versions up to and including 44.1. This occurs when the use_id_token_parser_v2 option is enabled.

The WPO365 | Login plugin for WordPress up to version 43.2 is vulnerable to Cross-Site Request Forgery. The Ajax request verification can be disabled, allowing an unauthenticated attacker to overwrite arbitrary plugin options, including enabling the SCIM REST endpoint, setting a known SCIM token, and assigning administrator role to new users.