WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.1 - Unauthenticated Authentication Bypass via SAML Response Replay
- ID
- WPSEC-2026-2550
- Plugin
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (wpo365-login)
- Affected
- all versions before 45.2
- Remediation
- Update to 45.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness
- CWE-294
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-05
- Attack surface
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) on WPSec AttackSurface
- Fix released
- Published
Description
The WPO365 plugin for WordPress is vulnerable to Authentication Bypass via SAML response replay in all versions up to, and including, 45.1, due to ineffective SAML 2.0 replay protection. The transient-based message ID check in Saml2_Service::check_message_id() never stored a message ID, because when no list existed yet it built one and returned without saving it. It also recorded the response ID rather than the assertion ID. Responses were processed without binding them to an issued AuthnRequest. This makes it possible for unauthenticated attackers who have obtained a valid signed SAML response for a user to replay it while the assertion is still valid and sign in to the site as that user. Exploitation requires that SAML 2.0 single sign-on is configured and that the attacker has captured a SAML response.
References
- https://wpsec.com/vuln/WPSEC-2026-2550/
- https://plugins.svn.wordpress.org/wpo365-login/tags/45.2/
- https://wordpress.org/plugins/wpo365-login/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS