CVE-2026-122220WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.

9.1 CRITICALEPSS 0.32%Not in KEVNVD: Received

Last updated: 2026-11-05 20:17 UTC

OverviewCVSS details

9.1CRITICALCVSS 4.0

Score source: VulnCheck (CNA)
NVD status: Received
Published: Nov 4, 2026
Assigner: VulnCheck

Affected

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (wpo365)

Versions: before 45.2
Fixed in: 45.2

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —
SSVC: Exploitation none · Automatable no · Impact total

EPSS · FIRST, scored Nov 7

0.32%chance of exploitation in 30 days

Higher than 26.20% of CVEs

CVSS 4.0 · VulnCheck (CNA)

9.1Critical

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: None
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulnCheck (CNA)

7.4High

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: None

NVD status: Received

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.1	CRITICAL	4.0VulnCheck (CNA)	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
7.4	HIGH	3.1VulnCheck (CNA)	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CVE ID: CVE-2026-122220
Status: Received
Assigner (CNA): VulnCheck
Published: Nov 4, 2026
Last modified: 2026-11-05 20:17 UTC
Weaknesses: CWE-294 · Authentication Bypass by Capture-replay

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 10:24 UTC.