WPO365 LOGIN SAML replay check bypass lets captured logins be reused

A WordPress login plugin can let attackers into admin accounts.

Summary

The WPO365 | LOGIN WordPress plugin (before 45.2) never records used SAML login responses, so it accepts them again. An attacker who captures a signed login response can replay it repeatedly to log in as any user, including administrators.

Affected when

attacker captured a validly-signed SAML login response

What to do

Update WPO365 LOGIN to version 45.2 or newer. The sources name no temporary setting.

Products and platforms

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

CVE IDs

CVE-2026-122220 (opens in a new tab)

Sources

Write-up: vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-04 20:09 UTC

First seen 2026-11-09 16:00 UTC