The WPO365 | Login plugin for WordPress is vulnerable to CSRF due to the Ajax_Service::verify_ajax_request() gating its wp_verify_nonce() call behind an option ('enable_nonce_check') that is absent from the default configuration and thus evaluates to false. Consequently, the wp_ajax_wpo365_update_settings AJAX handler accepts cross-origin POST requests without nonce verification. Attackers can supply a base64-encoded JSON 'settings' payload that is merged into the plugin's options without any key allowlist, allowing arbitrary option overwrites. This includes enabling the SCIM REST endpoint, planting attacker-controlled tokens, and setting the default new user role to administrator. Exploitation requires tricking a site administrator into performing an action such as clicking a crafted link.

Successful exploitation allows unauthenticated attackers to perform unauthorized changes to plugin settings, potentially enabling backdoor access via the SCIM REST endpoint and elevating privileges by setting the default new user role to administrator. This can lead to full site compromise, including confidentiality, integrity, and availability impacts as reflected by the CVSS score of 8.8.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid clicking on untrusted links and consider disabling or restricting access to the affected AJAX endpoint if possible. Monitor official vendor channels for updates and apply patches promptly once released.