CVE-2026-15212: WordPress WPO365 Login Plugin Cross-Site Request Forgery Vulnerability

Unauthenticated attackers can exploit CVE-2026-15212, a critical Cross-Site Request Forgery (CSRF) vulnerability present in the WPO365 | Login plugin for WordPress, affecting all versions up to and including 43.2. This vulnerability stems from a logical flaw in the Ajax_Service::verify_ajax_request() function, where the wp_verify_nonce() call is conditionally enabled by an option (enable_nonce_check) that defaults to false. As a result, the wp_ajax_wpo365_update_settings handler processes POST requests from any origin, forwarding attacker-controlled base64/JSON settings payloads directly to Options_Service::update_options(). This function then merges these arbitrary key/value pairs into the wpo365_options array without proper validation or an allowlist. By leveraging this, attackers can trick a site administrator into clicking a malicious link, allowing them to overwrite critical plugin options such as enabling the SCIM REST endpoint, planting a custom scim_secret_token, and setting new_usr_default_role to 'administrator'. This can lead to complete site compromise and unauthorized administrative control.

Attack Chain

1. An attacker crafts a malicious web page or link containing a forged POST request targeting the vulnerable WordPress site.
2. The attacker socially engineers a logged-in WordPress administrator to visit the malicious web page or click the crafted link.
3. The administrator's browser, without their direct knowledge, sends a forged POST request to the WordPress site's wp-admin/admin-ajax.php endpoint, specifying the action wpo365_update_settings.
4. The WPO365 plugin's Ajax_Service::verify_ajax_request() helper fails to properly validate the nonce due to the enable_nonce_check option evaluating to false.
5. The wp_ajax_wpo365_update_settings handler (implemented by Ajax_Service::update_settings) accepts the attacker-supplied settings payload (encoded as base64/JSON) from the forged request.
6. The Options_Service::update_options() function merges the key/value pairs from the malicious settings payload into the wpo365_options array, overwriting arbitrary plugin configurations without validation.
7. This critical step allows the attacker to manipulate plugin options, such as enabling the enable_scim REST endpoint, injecting an attacker-known scim_secret_token, and setting the new_usr_default_role to 'administrator'.
8. With these manipulated settings, the attacker can either leverage the newly enabled SCIM endpoint with their known secret token or exploit the 'administrator' default role for new users to create administrative accounts, ultimately gaining full control over the WordPress site.

Impact

Successful exploitation of CVE-2026-15212 grants unauthenticated attackers the ability to completely compromise affected WordPress sites. This includes overwriting critical plugin configurations, enabling or disabling plugin functionalities, and most significantly, escalating privileges by setting the default role for new user registrations to 'administrator'. This directly leads to unauthorized administrative access, allowing attackers to take full control of the website, including content manipulation, data exfiltration, or further malware deployment. The vulnerability enables a direct path to full site takeover by bypassing intended security checks.

Recommendation

• Patch CVE-2026-15212 immediately by updating the WPO365 | Login plugin to version 43.3 or newer.
• Deploy the Sigma rule provided in this brief to detect suspicious activity related to CVE-2026-15212 exploitation attempts.
• Monitor web server logs for HTTP POST requests to the /wp-admin/admin-ajax.php endpoint where the action parameter is wpo365_update_settings.