Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-122220

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by…

Risk score
49/100
CVSS
7.4 v3.1
Published
4 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error tha…
Affected
See advisory
Fix
Upgrade the product to 45.2 or later.
Exploitation
No known exploitation

Why it is Yellow

  • CVSS 7.4 high
  • Remotely exploitable without logging in

References

Original description

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.

Last activity 4 Nov 2026. Patch Forecast updates every hour.