{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/wpo365--login-plugin--43.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-15212"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPO365 | Login plugin (\u003c= 43.2)"],"_cs_severities":["high"],"_cs_tags":["wordpress","plugin","csrf","vulnerability","web"],"_cs_type":"advisory","_cs_vendors":["WPO365"],"content_html":"\u003cp\u003eUnauthenticated attackers can exploit CVE-2026-15212, a critical Cross-Site Request Forgery (CSRF) vulnerability present in the WPO365 | Login plugin for WordPress, affecting all versions up to and including 43.2. This vulnerability stems from a logical flaw in the \u003ccode\u003eAjax_Service::verify_ajax_request()\u003c/code\u003e function, where the \u003ccode\u003ewp_verify_nonce()\u003c/code\u003e call is conditionally enabled by an option (\u003ccode\u003eenable_nonce_check\u003c/code\u003e) that defaults to false. As a result, the \u003ccode\u003ewp_ajax_wpo365_update_settings\u003c/code\u003e handler processes POST requests from any origin, forwarding attacker-controlled base64/JSON \u003ccode\u003esettings\u003c/code\u003e payloads directly to \u003ccode\u003eOptions_Service::update_options()\u003c/code\u003e. This function then merges these arbitrary key/value pairs into the \u003ccode\u003ewpo365_options\u003c/code\u003e array without proper validation or an allowlist. By leveraging this, attackers can trick a site administrator into clicking a malicious link, allowing them to overwrite critical plugin options such as enabling the SCIM REST endpoint, planting a custom \u003ccode\u003escim_secret_token\u003c/code\u003e, and setting \u003ccode\u003enew_usr_default_role\u003c/code\u003e to 'administrator'. This can lead to complete site compromise and unauthorized administrative control.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious web page or link containing a forged POST request targeting the vulnerable WordPress site.\u003c/li\u003e\n\u003cli\u003eThe attacker socially engineers a logged-in WordPress administrator to visit the malicious web page or click the crafted link.\u003c/li\u003e\n\u003cli\u003eThe administrator's browser, without their direct knowledge, sends a forged POST request to the WordPress site's \u003ccode\u003ewp-admin/admin-ajax.php\u003c/code\u003e endpoint, specifying the action \u003ccode\u003ewpo365_update_settings\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe WPO365 plugin's \u003ccode\u003eAjax_Service::verify_ajax_request()\u003c/code\u003e helper fails to properly validate the nonce due to the \u003ccode\u003eenable_nonce_check\u003c/code\u003e option evaluating to false.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ewp_ajax_wpo365_update_settings\u003c/code\u003e handler (implemented by \u003ccode\u003eAjax_Service::update_settings\u003c/code\u003e) accepts the attacker-supplied \u003ccode\u003esettings\u003c/code\u003e payload (encoded as base64/JSON) from the forged request.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eOptions_Service::update_options()\u003c/code\u003e function merges the key/value pairs from the malicious \u003ccode\u003esettings\u003c/code\u003e payload into the \u003ccode\u003ewpo365_options\u003c/code\u003e array, overwriting arbitrary plugin configurations without validation.\u003c/li\u003e\n\u003cli\u003eThis critical step allows the attacker to manipulate plugin options, such as enabling the \u003ccode\u003eenable_scim\u003c/code\u003e REST endpoint, injecting an attacker-known \u003ccode\u003escim_secret_token\u003c/code\u003e, and setting the \u003ccode\u003enew_usr_default_role\u003c/code\u003e to 'administrator'.\u003c/li\u003e\n\u003cli\u003eWith these manipulated settings, the attacker can either leverage the newly enabled SCIM endpoint with their known secret token or exploit the 'administrator' default role for new users to create administrative accounts, ultimately gaining full control over the WordPress site.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-15212 grants unauthenticated attackers the ability to completely compromise affected WordPress sites. This includes overwriting critical plugin configurations, enabling or disabling plugin functionalities, and most significantly, escalating privileges by setting the default role for new user registrations to 'administrator'. This directly leads to unauthorized administrative access, allowing attackers to take full control of the website, including content manipulation, data exfiltration, or further malware deployment. The vulnerability enables a direct path to full site takeover by bypassing intended security checks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-15212 immediately by updating the WPO365 | Login plugin to version 43.3 or newer.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule provided in this brief to detect suspicious activity related to CVE-2026-15212 exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for HTTP POST requests to the \u003ccode\u003e/wp-admin/admin-ajax.php\u003c/code\u003e endpoint where the \u003ccode\u003eaction\u003c/code\u003e parameter is \u003ccode\u003ewpo365_update_settings\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-23T20:19:02Z","date_published":"2026-07-23T20:19:02Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-15212-wpo365-csrf/","summary":"A Cross-Site Request Forgery (CSRF) vulnerability in the WPO365 | Login plugin for WordPress, affecting versions up to and including 43.2, allows unauthenticated attackers to overwrite arbitrary plugin options. This is due to a misconfiguration where the nonce check is effectively disabled. By tricking a site administrator into clicking a malicious link, an attacker can manipulate settings such as enabling the SCIM REST endpoint, planting a SCIM secret token, and setting the default user role for new registrations to 'administrator', potentially leading to full site compromise and unauthorized administrative access.","title":"CVE-2026-15212: WordPress WPO365 Login Plugin Cross-Site Request Forgery Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-15212-wpo365-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - WPO365 | Login Plugin (\u003c= 43.2)","version":"https://jsonfeed.org/version/1.1"}