Wpo365 Seamless Wordpress Microsoft Integration Wpo365 Login
Monthly
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin for WordPress, affecting all versions up to and including 44.1, lets unauthenticated remote attackers inject arbitrary HTML/JavaScript that is persisted for up to three days. A forged 'id_token' whose base64url-decoded unique_name or iss claim carries malicious markup survives the plugin's token-to-error logging path (Id_Token_Service) and lands in the wpo365_errors transient with no sanitization on input and no escaping on output, so the injected script executes when a WordPress administrator later opens the WPO365 wizard page. Because the assessed vector is PR:N/UI:R, no credentials are needed to plant the payload, but the attacker is dependent on an administrator visiting the affected admin screen inside the transient's roughly three-day window; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the vendor has shipped a fixed release (45.0). Impact is bounded to low confidentiality and integrity within the WordPress admin context (no availability impact), which makes this a legitimately notable but not emergency-tier issue.
Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.
Replaying a previously-issued OIDC id_token allows unauthenticated attackers to bypass authentication in WPO365 Login (≤44.1) and take over any WordPress account, including administrators. The flaw is gated by the non-default use_id_token_parser_v2 option and requires a valid id_token for the target account. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the WPO365 | Login (Seamless WordPress + Microsoft Integration) plugin for WordPress, affecting all versions up to and including 44.1, lets unauthenticated remote attackers inject arbitrary HTML/JavaScript that is persisted for up to three days. A forged 'id_token' whose base64url-decoded unique_name or iss claim carries malicious markup survives the plugin's token-to-error logging path (Id_Token_Service) and lands in the wpo365_errors transient with no sanitization on input and no escaping on output, so the injected script executes when a WordPress administrator later opens the WPO365 wizard page. Because the assessed vector is PR:N/UI:R, no credentials are needed to plant the payload, but the attacker is dependent on an administrator visiting the affected admin screen inside the transient's roughly three-day window; there is no confirmed active exploitation and no public exploit code identified at time of analysis, though the vendor has shipped a fixed release (45.0). Impact is bounded to low confidentiality and integrity within the WordPress admin context (no availability impact), which makes this a legitimately notable but not emergency-tier issue.
Privilege escalation via Cross-Site Request Forgery affects the WPO365 | Login plugin for WordPress (versions up to and including 43.2), where an unauthenticated attacker who tricks a logged-in administrator into clicking a crafted link can overwrite arbitrary plugin options and seize control of the site. The root cause is that the AJAX settings handler's nonce check is gated behind an 'enable_nonce_check' option that is absent from the default configuration, so it silently evaluates to false and no CSRF protection runs. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the technical write-up from Wordfence is detailed enough to make reproduction straightforward, and the 8.8 CVSS reflects the full-takeover potential.