{
 "id": "WPSEC-2026-1951",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1951/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1951/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1951/index.md",
 "title": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.8 - Unauthenticated Missing Authorization to SharePoint Refresh Token Deletion and Replacement",
 "description": "The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to unauthorized modification and loss of data via the SharePoint (SPS) OAuth callback in moazure_login_validate() in all versions up to, and including, 2.2.8. This is due to a missing capability check: the callback branch runs for any request carrying a 'code' parameter and a 'moazure_sps' cookie or session value, and the requester can set that cookie themselves. This makes it possible for unauthenticated attackers to delete the site's stored Microsoft refresh token, which breaks the SharePoint integration. The attacker can also have the site exchange an authorization code they supply and store the resulting refresh token in its place.",
 "plugin": {
  "slug": "login-with-azure",
  "name": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login",
  "full_name": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login",
  "wordpress_org": "https://wordpress.org/plugins/login-with-azure/",
  "advisories_url": "https://wpsec.com/vuln/plugin/login-with-azure/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/login-with-azure"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.2.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.2.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.2.9",
 "remediation": "Update to 2.2.9 or later.",
 "fix_released": "2026-10-28T10:16:52+00:00",
 "published": "2026-10-29T18:50:39+00:00",
 "updated": "2026-10-29T17:47:04.773800+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1951/",
  "https://plugins.svn.wordpress.org/login-with-azure/tags/2.2.9/",
  "https://wordpress.org/plugins/login-with-azure/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/login-with-azure",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-29"
 }
}