WPO365 CVE-2026-102915

Requires a valid authenticated account at Subscriber level (the lowest WordPress role), consistent with PR:L - not a pre-authentication bypass despite the 'Authentication Bypass' tag. The practical prerequisite is that the target WordPress site permits user registration (or the attacker otherwise holds any low-tier account); sites that disable self-registration and have no untrusted low-privilege users substantially limit exposure. Affected deployments run WPO365 at version 44.1 or earlier; no victim user interaction is needed (UI:N), and exploitation is network-reachable (AV:N) against the WordPress site's normal web interface.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N, base 8.5 HIGH) indicates a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) with no user interaction, a scope change (S:C), and high confidentiality impact - consistent with a low-tier WordPress account (the description's 'Subscriber') abusing a missing authorization check (CWE-862) to reach data or functions above its role. No EPSS probability, CISA KEV entry, or POC indicator is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk signal here rests entirely on the CVSS/CWE characterization from Patchstack, not on observed in-the-wild activity. The one internal tension worth verifying: the input Tags label this 'Authentication Bypass,' but the description and CWE-862 describe broken access control / missing authorization AFTER authentication (PR:L requires a valid subscriber account), which is a distinct and more limited condition than a true pre-auth bypass - treat this as a post-authentication privilege/access issue. Net: a genuine HIGH-severity authorization defect that matters for any site allowing untrusted user self-registration, but absent EPSS/KEV/POC it is a 'patch-promptly' item rather than a confirmed emergency.

A site using WPO365 permits open or low-friction user registration, so an attacker registers (or obtains) an ordinary Subscriber-level account. Because an authorization check is missing on a plugin endpoint, the authenticated subscriber then invokes functionality or reads data intended only for higher-privileged roles, exposing sensitive configuration or Microsoft 365/Azure integration information. No public exploit code is identified at time of analysis, and no user interaction by a victim is required.