CVE-2026-122220 · Package
NO FIX YET · SEE WHAT TO DO
The WPO365 | LOGIN WordPress plugin before version 45.2 fails to record SAML message IDs, so its replay check never fires. An attacker who captures a valid SAMLResponse can replay it within the assertion validity window and log in as the victim, including administrators.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the WPO365 | LOGIN plugin older than 45.2 with SAML single sign-on enabled are exposed. An attacker must capture a valid signed SAML response, which the description says is possible, so sites without SAML login in use can skip it.
Not affected if plugin-version-45.2-or-later, saml-login-not-used
Who cares microsoft-365, saml-sso, wordpress, wpo365-login
wpo365-login plugin in the WordPress admin plugins list or wp plugin get wpo365-login --field=version.45.2 or later (per the NVD description: before version 45.2 is affected).WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.