The WPO365 | Login plugin for WordPress is vulnerable to CSRF in versions <=43.2 due to the Ajax_Service::verify_ajax_request() gating its wp_verify_nonce() call behind a boolean option 'enable_nonce_check' which is absent from default settings and thus evaluates to false. Consequently, the wp_ajax_wpo365_update_settings handler accepts cross-origin POST requests without proper nonce verification. Attackers can supply a base64/JSON 'settings' payload that is merged without key restrictions into plugin options, enabling overwriting of critical settings such as enabling the SCIM REST endpoint, planting attacker-known tokens, and setting default user roles to administrator. This vulnerability requires tricking a site administrator into performing an action like clicking a malicious link.

Successful exploitation allows unauthenticated attackers to overwrite arbitrary plugin options, potentially enabling sensitive endpoints, planting attacker-controlled tokens, and elevating user privileges by setting new users' default role to administrator. This compromises confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid clicking untrusted links and consider disabling or restricting access to the affected plugin's settings update functionality. Monitor vendor channels for updates and apply patches promptly once released.