# All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.8 - Unauthenticated Missing Authorization to SharePoint Refresh Token Deletion and Replacement

- **ID:** WPSEC-2026-1951
- **Plugin:** All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login (`login-with-azure`), https://wordpress.org/plugins/login-with-azure/
- **Affected versions:** all versions before 2.2.9
- **Fixed in:** 2.2.9 (Update to 2.2.9 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/login-with-azure
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1951/

## Description

The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to unauthorized modification and loss of data via the SharePoint (SPS) OAuth callback in moazure_login_validate() in all versions up to, and including, 2.2.8. This is due to a missing capability check: the callback branch runs for any request carrying a 'code' parameter and a 'moazure_sps' cookie or session value, and the requester can set that cookie themselves. This makes it possible for unauthenticated attackers to delete the site's stored Microsoft refresh token, which breaks the SharePoint integration. The attacker can also have the site exchange an authorization code they supply and store the resulting refresh token in its place.

## References

- https://wpsec.com/vuln/WPSEC-2026-1951/
- https://plugins.svn.wordpress.org/login-with-azure/tags/2.2.9/
- https://wordpress.org/plugins/login-with-azure/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1951/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.