CVE-2026-122220

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.1 - Authentication Bypass via SAML Relay

2026-11-04 00:00

Strategic Overview

Status: Patched in 45.2
Affected Plugin: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
Affected Version: <= 45.1
CVSS: 6.3Medium
Weakness type: CWE-294 · Authentication Bypass by Capture-replay
CVE: CVE-2026-122220

View all WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) vulnerabilities

At a glance

CVE-2026-122220 is a medium-severity Authentication Bypass by Capture-replay vulnerability in the WPO365 WordPress plugin, affecting versions <= 45.1. It carries a CVSS score of 6.3 (reachable over the network; low attack complexity). The issue is fixed in version 45.2; sites on affected versions should update now. Disclosed November 2026, reported by buiih.

Vulnerability Overview

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 45.1. This is due to a logic error in Saml2_Service::check_message_id() that returned before persisting processed SAML message IDs to the wpo365_saml_message_ids transient, rendering the anti-replay check non-functional. This makes it possible for unauthenticated attackers to replay a captured, validly-signed SAMLResponse to the ACS endpoint and authenticate as any victim user, including administrators, within the assertion's validity window. SAML 2.0 single sign-on must be enabled and the attacker must be able to capture a legitimately-signed SAMLResponse for the target user.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-294: Authentication Bypass by Capture-replay

A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Remediation

Update to version 45.2, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: WPO365 45.2 closes this, and updating the plugin is the step that ends it.

Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-122220 https://www.wordfence.com/threat-intel/vulnerabilities/id/4dca441a-5955-4624-bc9a-102b628725f4 https://nvd.nist.gov/vuln/detail/CVE-2026-122220

Related records

Other vulnerabilities in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

CVSS Vector

6.3

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Base

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityLow

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/