EUVD-2026-48382
GHSA-4w3q-g484-rj57
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Unauthenticated network CSRF (PR:N, AV:N, AC:L) needs admin to click (UI:R); arbitrary option overwrite enabling admin creation yields full C/I/A high.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options - including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' - via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
AnalysisAI
Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.
Technical ContextAI
The vulnerability lives in the plugin's AJAX layer (Ajax_Service::verify_ajax_request()), which is supposed to call wp_verify_nonce() to prove that a state-changing request originated from the WordPress admin UI. That call is conditionally executed only when the boolean option 'enable_nonce_check' is true; because that key is not present in the default 'wpo365_options' array, get_global_boolean_var() returns false and the nonce verification is skipped entirely. The wp_ajax_wpo365_update_settings hook therefore reaches Ajax_Service::update_settings(), which decodes an attacker-supplied base64/JSON 'settings' payload and passes it to Options_Service::update_options(), which blindly merges every key/value into wpo365_options with no allowlist. This is the textbook shape of CWE-352 (Cross-Site Request Forgery) compounded by a missing input allowlist: a security control exists in code but is disabled by default, and the write path trusts arbitrary keys. The affected component is identified by CPE cpe:2.3:a:wpo365:wpo365_|_seamless_wordpress_+_microsoft_integration_(wpo365_|_login), a plugin that bridges WordPress authentication and user provisioning with Microsoft Entra ID/Azure AD, which is why SCIM provisioning options are among the sensitive settings that can be tampered with.
RemediationAI
Upgrade the WPO365 | Login plugin to the fixed release published after 43.2; an upstream fix is available as SVN changeset 3610759 (https://plugins.trac.wordpress.org/changeset/3610759/wpo365-login), but a specific tagged patched version is not stated in the available data, so confirm the exact release on the plugin page before relying on a version number. If immediate upgrade is not possible, the most direct compensating control is to explicitly enable the 'enable_nonce_check' option in the plugin configuration so that wp_verify_nonce() actually runs on the AJAX settings handler - this restores CSRF protection with essentially no functional downside. As additional hardening, restrict or disable the plugin's SCIM REST endpoint (enable_scim) if you do not use Microsoft-driven provisioning, audit wpo365_options for unexpected values (particularly scim_secret_token and new_usr_default_role), and place the wp-admin/wp-ajax surface behind a WAF or admin-IP allowlist to reduce the chance a forged request reaches an authenticated admin session; note the WAF/IP controls add operational friction and do not fix the underlying missing check. Consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/51d0ba58-614e-4284-ae0b-b0b76fc5c46d) for detection guidance.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today