# WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 45.2 - Unauthenticated Authentication Bypass via SAML Signature Verification

- **ID:** WPSEC-2026-3033
- **Plugin:** WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (`wpo365-login`), https://wordpress.org/plugins/wpo365-login/
- **Affected versions:** all versions before 45.3
- **Fixed in:** 45.3 (Update to 45.3 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-347
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpo365-login
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3033/

## Description

The WPO365 | LOGIN plugin for WordPress is vulnerable to Authentication Bypass via SAML 2.0 signature verification in all versions up to, and including, 45.2, due to the bundled xmlseclibs library accepting a false or empty canonicalization result and evaluating XPath transforms taken from the document during signature verification (CVE-2025-66475, CVE-2025-66578, GHSA-7mf5-fjj8-mvjc). This makes it possible for unauthenticated attackers to submit a crafted SAML response that passes the signature check and sign in as another user, potentially an administrator. Exploitation requires SAML 2.0 single sign-on to be configured on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-3033/
- https://plugins.svn.wordpress.org/wpo365-login/tags/45.3/
- https://wordpress.org/plugins/wpo365-login/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3033/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.