{"id":"CVE-2026-104759","published":"2026-10-10T08:17:04.070","lastModified":"2026-10-13T13:30:21.620","description":"The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Id_Token_Service.php#L107","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Id_Token_Service_Deprecated.php#L110","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Nonce_Service.php#L72","tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Router_Service.php#L275","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3727410/wpo365-login","tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&new=3727410%40wpo365-login%2Ftags%2F45.0&old=3682496%40wpo365-login%2Ftags%2F44.1","tags":[]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/aad7ddac-ed12-4263-8e68-64b1fca8dfad?source=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WPO365 plugin contains a critical authentication bypass vulnerability where attackers can replay valid OpenID Connect ID tokens to impersonate any user, including administrators, due to a nonce verification flaw that silently fails during authentication.","exploitability":"Exploitation requires an attacker to obtain a valid id_token from a target account and ensure the 'use_id_token_parser_v2' option is enabled, making it moderately difficult but possible to achieve full site takeover.","blast_radius":"If exploited, this vulnerability could lead to complete compromise of WordPress sites using the affected plugin, allowing attackers to gain administrative control over user accounts and potentially access sensitive data or modify site content.","remediation":"Disable the 'use_id_token_parser_v2' option immediately or upgrade to version 44.2 or later if available.","detection":"Monitor for failed authentication attempts followed by successful authentications using previously valid tokens, particularly in authentication logs where nonce verification failures occur silently.","tags":["auth-bypass","oidc","wordpress","plugin"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:57:13.868Z"}}