WPO365 | LOGIN (< 45.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/wpo365--login--45.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 21:13:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWPO365 | LOGIN: Authentication bypass via SAML replay (CVE-2026-122220)https://feed.craftedsignal.io/briefs/2026-11-wpo365-auth-bypass/Wed, 04 Nov 2026 21:13:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-wpo365-auth-bypass/The WPO365 | LOGIN plugin for WordPress fails to persist SAML message IDs, enabling attackers to perform replay attacks against the ACS endpoint to bypass authentication.The WPO365 | LOGIN plugin for WordPress contains an authentication bypass vulnerability (CVE-2026-122220) due to a logic error in the Saml2_Service::check_message_id() function. The function fails to persist processed SAML message IDs to the wpo365_saml_message_ids transient cache because the code returns prematurely. As a result, the plugin cannot effectively enforce anti-replay checks for SAML assertions.

Impact

An unauthenticated attacker who successfully captures a validly-signed SAML response can replay that assertion against the plugin ACS endpoint. This allows for unauthorized access to the application as the authenticated user, including users with administrative privileges, until the assertion validity window expires.

Recommendation

  • Update the WPO365 | LOGIN plugin to version 45.2 or later immediately to resolve the persistence logic error in the SAML response validator.
  • Audit existing SAML configurations to ensure that the IdP and SP are strictly enforcing assertion lifetimes to minimize the window of opportunity for potential replay attacks.
]]>highadvisory