{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wpo365--login--45.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wpo365:login:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-122220"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPO365 | LOGIN (\u003c 45.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WPO365"],"content_html":"\u003cp\u003eThe WPO365 | LOGIN plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-122220) due to a logic error in the \u003ccode\u003eSaml2_Service::check_message_id()\u003c/code\u003e function. The function fails to persist processed SAML message IDs to the \u003ccode\u003ewpo365_saml_message_ids\u003c/code\u003e transient cache because the code returns prematurely. As a result, the plugin cannot effectively enforce anti-replay checks for SAML assertions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn unauthenticated attacker who successfully captures a validly-signed SAML response can replay that assertion against the plugin ACS endpoint. This allows for unauthorized access to the application as the authenticated user, including users with administrative privileges, until the assertion validity window expires.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the WPO365 | LOGIN plugin to version 45.2 or later immediately to resolve the persistence logic error in the SAML response validator.\u003c/li\u003e\n\u003cli\u003eAudit existing SAML configurations to ensure that the IdP and SP are strictly enforcing assertion lifetimes to minimize the window of opportunity for potential replay attacks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T21:13:36Z","date_published":"2026-11-04T21:13:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-wpo365-auth-bypass/","summary":"The WPO365 | LOGIN plugin for WordPress fails to persist SAML message IDs, enabling attackers to perform replay attacks against the ACS endpoint to bypass authentication.","title":"WPO365 | LOGIN: Authentication bypass via SAML replay (CVE-2026-122220)","url":"https://feed.craftedsignal.io/briefs/2026-11-wpo365-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - WPO365 | LOGIN (\u003c 45.2)","version":"https://jsonfeed.org/version/1.1"}