# WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.2 - Unauthenticated Sensitive Information Exposure via SAML Encrypted Assertion Decryption Oracle

- **ID:** WPSEC-2026-3032
- **Plugin:** WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (`wpo365-login`), https://wordpress.org/plugins/wpo365-login/
- **Affected versions:** all versions before 45.3
- **Fixed in:** 45.3 (Update to 45.3 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-327
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpo365-login
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3032/

## Description

The WPO365 | LOGIN plugin for WordPress is vulnerable to Sensitive Information Exposure via encrypted SAML assertion decryption in all versions up to, and including, 45.2, due to the bundled SAML library letting attacker-supplied EncryptedData name an asymmetric algorithm, so that the service provider's private RSA key decrypts attacker-supplied data directly, and to mcrypt-based CBC algorithms failing only after the RSA key transport was decrypted (GHSA-39hg-wfcm-v4wv). This makes it possible for unauthenticated attackers to use the site as a decryption oracle against data encrypted for the service provider's key. Exploitation requires SAML 2.0 single sign-on with a service provider private key (encrypted assertions) to be configured.

## References

- https://wpsec.com/vuln/WPSEC-2026-3032/
- https://plugins.svn.wordpress.org/wpo365-login/tags/45.3/
- https://wordpress.org/plugins/wpo365-login/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3032/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.