---
id: "CVE-2026-122220"
kind: "vulnerability"
aliases: ["CVE-2026-122220"]
title: "WordPress WPO365 Login plugin: captured SAML login replayable to gain access"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["microsoft-365", "package", "saml-sso", "wordpress", "wpo365-login"]
not_affected_if: ["plugin-version-45.2-or-later", "saml-login-not-used"]
published_at: "2026-11-04T20:19:12+00:00"
first_seen_at: "2026-11-04T20:29:03+00:00"
updated_at: "2026-11-04T20:29:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122220", "first_seen_at": "2026-11-04T20:29:03+00:00"}]
---

# WordPress WPO365 Login plugin: captured SAML login replayable to gain access

The WPO365 | LOGIN WordPress plugin before version 45.2 fails to record SAML message IDs, so its replay check never fires. An attacker who captures a valid SAMLResponse can replay it within the assertion validity window and log in as the victim, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the `wpo365-login` plugin in the WordPress admin plugins list or `wp plugin get wpo365-login --field=version`.
- Confirm whether single sign-on through SAML is enabled for the site.

## Fix

- WPO365 | LOGIN `45.2` or later (per the NVD description: before version 45.2 is affected).

## Timeline

- 2026-11-04T20:29:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122220

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/wpo365-login-before-saml-replay-protection-bypass

## From the sources

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_