1 vulnerability across 1 product scored HIGH or above on November 04, 2026.

  • 🟠 HIGH: 1

🟠 [HIGH] wpo365/wpo365_|seamless_wordpress+microsoft_integration(wpo365_|_login)

1 CVE | CVSS 4.0: 9.1 | AAS 9.4

  • cpe:2.3:a:wpo365:wpo365_seamless_wordpress_microsoft_integration_wpo365_login:*:*:*:*:*:*:*:* (< 45.2)

WPO365 Login, a WordPress plugin providing seamless Microsoft integration and SAML-based single sign-on, is affected by one high-severity vulnerability. CVE-2026-122220 carries a CVSS 4.0 score of 9.1 and allows authentication bypass through SAML response replay. A logic error in the anti-replay check causes the plugin to never persist processed SAML message IDs, meaning an attacker who captures a legitimately signed SAMLResponse can replay it repeatedly within the assertion validity window to authenticate as the victim user. This is particularly dangerous for organizations relying on WPO365 as their primary authentication bridge between WordPress and Microsoft identity providers.

WordPress administrators using WPO365 Login (wpo365-login) should immediately update to version 45.2 or later, which corrects the flawed anti-replay logic. Security teams should also review authentication logs for any signs of repeated SAML assertion reuse and consider rotating affected user sessions. The vendor changeset detailing the fix is available at the WordPress plugin repository.

Vendor Advisory