WPO365 Login CVE-2026-104759

Two concrete conditions must both hold: (1) the plugin option use_id_token_parser_v2 must be enabled, as this is the only configuration that routes token processing through Id_Token_Service_Deprecated::process_openidconnect_token() containing the broken nonce check; and (2) the attacker must already possess a previously-issued, valid OIDC id_token for the target WordPress account (the flaw enables replay of such a token, not forgery of a new one). Limiting factors for defenders: use_id_token_parser_v2 is a non-default routing option, no WordPress authentication is required (PR:N), no user interaction is needed (UI:N), and the attack is network-reachable but constrained by the need to first acquire a legitimate id_token - which is why CVSS rates attack complexity as High.

This is a serious-impact but precondition-gated authentication bypass (CWE-287) rather than a mass-exploitable flaw. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1) is internally consistent with the description: PR:N reflects that the attacker needs no prior WordPress account, while AC:H correctly captures the two real prerequisites - the attacker must first obtain a previously-issued valid id_token for the target account, and the site must be running the non-default use_id_token_parser_v2 option that routes tokens through the broken deprecated parser. No EPSS score, SSVC decision, KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Weighing these signals together: technical impact is total (admin takeover / full site compromise), but automatability is low because successful exploitation depends on stealing or replaying a valid OIDC id_token and on a specific opt-in configuration - this is closer to a targeted bypass than an opportunistic internet-wide mass-exploitation candidate. Treat as high priority for sites confirmed to run WPO365 Login with use_id_token_parser_v2 enabled, and lower priority elsewhere. No conflicting signals were found between the CVSS vector and the description; both agree on remote, unauthenticated, config-dependent access.

An attacker who has captured or otherwise obtained a valid, previously-issued OIDC id_token for a target account (e.g. an administrator) replays that token to the plugin's OIDC callback on a site where use_id_token_parser_v2 is enabled. Because the deprecated parser validates the 64-char hex nonce with the wrong WordPress core function (wp_verify_nonce), the nonce check silently fails without stopping authentication, and the attacker is logged in as that user. No public exploit code is identified at time of analysis, though the vulnerable code paths are directly linked in the Wordfence/wordpress.org trac references.