All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.8 - Unauthenticated Missing Authorization to SharePoint Refresh Token Deletion and Replacement
- ID
- WPSEC-2026-1951
- Plugin
- All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login (login-with-azure)
- Affected
- all versions before 2.2.9
- Remediation
- Update to 2.2.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-29
- Attack surface
- All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login on WPSec AttackSurface
- Fix released
- Published
Description
The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to unauthorized modification and loss of data via the SharePoint (SPS) OAuth callback in moazure_login_validate() in all versions up to, and including, 2.2.8. This is due to a missing capability check: the callback branch runs for any request carrying a 'code' parameter and a 'moazure_sps' cookie or session value, and the requester can set that cookie themselves. This makes it possible for unauthenticated attackers to delete the site's stored Microsoft refresh token, which breaks the SharePoint integration. The attacker can also have the site exchange an authorization code they supply and store the resulting refresh token in its place.
References
- https://wpsec.com/vuln/WPSEC-2026-1951/
- https://plugins.svn.wordpress.org/login-with-azure/tags/2.2.9/
- https://wordpress.org/plugins/login-with-azure/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS