CVE-2026-104759: CWE-287 Improper Authentication in wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
Description
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.
CVSS v3.1
Score 8.1high
Affected software
wpo365
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-104759 is an authentication bypass vulnerability in the WPO365 WordPress plugin caused by improper nonce validation. The deprecated token processing function uses WordPress's wp_verify_nonce() to validate a nonce generated as a 64-character hex string, which wp_verify_nonce() cannot verify. This causes the nonce check to fail silently, allowing execution to continue with an attacker-supplied ID token. Attackers who have obtained a valid previously issued ID token can replay it to authenticate as any user, including administrators. The vulnerability affects all versions up to and including 44.1 and requires the 'use_id_token_parser_v2' plugin option to be enabled for exploitation.
Potential Impact
Successful exploitation allows unauthenticated attackers to bypass authentication and impersonate any WordPress user, including administrators. This can lead to full site takeover, compromising confidentiality, integrity, and availability of the affected WordPress site.
Mitigation Recommendations
No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, disabling the 'use_id_token_parser_v2' plugin option will prevent exploitation by avoiding the vulnerable token processing path.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-10-02T12:27:26.024Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac9f1732cdf04f656158826
Added to database: 10/10/2026, 08:04:03 UTC
Last enriched: 10/10/2026, 08:18:32 UTC
Last updated: 10/10/2026, 21:26:59 UTC
Views: 16
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.