WPO365 | LOGIN: Authentication bypass via SAML replay (CVE-2026-122220)

The WPO365 | LOGIN plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-122220) due to a logic error in the Saml2_Service::check_message_id() function. The function fails to persist processed SAML message IDs to the wpo365_saml_message_ids transient cache because the code returns prematurely. As a result, the plugin cannot effectively enforce anti-replay checks for SAML assertions.

Impact

An unauthenticated attacker who successfully captures a validly-signed SAML response can replay that assertion against the plugin ACS endpoint. This allows for unauthorized access to the application as the authenticated user, including users with administrative privileges, until the assertion validity window expires.

Recommendation

• Update the WPO365 | LOGIN plugin to version 45.2 or later immediately to resolve the persistence logic error in the SAML response validator.
• Audit existing SAML configurations to ensure that the IdP and SP are strictly enforcing assertion lifetimes to minimize the window of opportunity for potential replay attacks.