WPO365 Login CVE-2026-15212

Exploitation requires the plugin to be running in its default state where 'enable_nonce_check' is absent/false (the shipped default), so no attacker authentication is needed, but it DOES require tricking a currently logged-in WordPress administrator into performing an action such as clicking an attacker link or visiting a malicious page (UI:R) so the forged cross-origin POST rides the admin's authenticated session to admin-ajax.php. Limiting factors: the victim must be an authenticated administrator with an active session at the time of the click; if a site operator has explicitly turned on 'enable_nonce_check', the wp_verify_nonce() gate closes and the CSRF fails; and there is no server-side compromise without the admin interaction, so purely automated mass exploitation is not viable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the described attack: network-reachable, low complexity, no attacker privileges, but requiring administrator user interaction (clicking a link), with high impact across confidentiality, integrity and availability because the attacker can escalate to a site-wide compromise. The main limiting factor is UI:R - this is not a wormable, zero-click flaw; it depends on social-engineering a logged-in admin. No EPSS score, KEV entry, or public POC was provided, so real-world exploitation probability cannot be quantified from the input and there is no public exploit identified at time of analysis; the signal that raises priority is the credibility of the Wordfence disclosure plus the very concrete exploitation path (enable_scim + scim_secret_token + new_usr_default_role=administrator), which turns an options-write into full administrative account creation. Net: this is a genuine high-priority patch-now issue for sites running the plugin, but the requirement for admin interaction means it is more suited to targeted phishing than mass automated exploitation. No conflicting signals were observed between the CVSS vector and the description.

An attacker crafts a malicious web page containing a hidden auto-submitting form (or a link) that POSTs a base64/JSON 'settings' payload to the site's admin-ajax.php wpo365_update_settings action, then phishes a site administrator into visiting it while logged in. Because the nonce check is disabled by default, the forged request succeeds and the payload flips enable_scim on, plants an attacker-known scim_secret_token, and sets new_usr_default_role to 'administrator', letting the attacker provision or elevate an account to full admin. No public POC was provided, but the Wordfence write-up documents the exact options needed.