Vulnerability in Wpo365 | Seamless WordPress + Microsoft Integration (Wpo365 Login)
CVE-2026-122220
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- plugins.trac.wordpress.org/changeset/3783469/ (issue-tracking)
- Vendor Patch (patch)
- VulnCheck Advisory: WPO365 LOGIN before 45.2 SAML Replay Protection Bypass (third-party-advisory)
Frequently asked questions
- What is CVE-2026-122220?
- CVE-2026-122220 is a high-severity vulnerability in Wpo365 | Seamless WordPress + Microsoft Integration (Wpo365 Login), classified under Authentication Bypass by Capture-replay. CVSS score: 7.4/10. Published 2026-11-04.
- How severe is CVE-2026-122220?
- High severity. CVSS v3 base score is 7.4 out of 10.