WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.2 - Unauthenticated Sensitive Information Exposure via SAML Encrypted Assertion Decryption Oracle
- ID
- WPSEC-2026-3032
- Plugin
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (wpo365-login)
- Affected
- all versions before 45.3
- Remediation
- Update to 45.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-327
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) on WPSec AttackSurface
- Fix released
- Published
Description
The WPO365 | LOGIN plugin for WordPress is vulnerable to Sensitive Information Exposure via encrypted SAML assertion decryption in all versions up to, and including, 45.2, due to the bundled SAML library letting attacker-supplied EncryptedData name an asymmetric algorithm, so that the service provider's private RSA key decrypts attacker-supplied data directly, and to mcrypt-based CBC algorithms failing only after the RSA key transport was decrypted (GHSA-39hg-wfcm-v4wv). This makes it possible for unauthenticated attackers to use the site as a decryption oracle against data encrypted for the service provider's key. Exploitation requires SAML 2.0 single sign-on with a service provider private key (encrypted assertions) to be configured.
References
- https://wpsec.com/vuln/WPSEC-2026-3032/
- https://plugins.svn.wordpress.org/wpo365-login/tags/45.3/
- https://wordpress.org/plugins/wpo365-login/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS