Advisory · CVE-2026-122220
SAML replay authentication bypass in WPO365 Login for WordPress
The WPO365 Login plugin before 45.2 fails to persist processed SAML message IDs, so an attacker who captures a validly signed SAML response can replay it to log in as the victim, including administrators. Rated critical at CVSS 4.0 9.1.
- Vendor
- WPO365
- Product
- WPO365 Login
- Identifier / CWE
- CVE-2026-122220
CWE-294 - Action timing
- Immediate
Explain it like I’m five
The login desk is supposed to stamp each visitor ticket as used, but the stamp step never happens. Anyone who copies a real signed ticket can hand it in again and again and walk in as that person, even the site administrator.
- 01Capture a signed response
An attacker captures a validly signed SAML response belonging to a victim user.
- 02Replay to the ACS endpoint
The attacker replays the captured response to the plugin assertion consumer endpoint within the assertion validity window.
- 03Anti-replay check never triggers
The duplicate message ID check never triggers because processed message IDs are never saved, due to a logic error that returns before saving.
- 04Login as the victim
The replayed response is accepted and the attacker is logged in as the victim, including administrators, without detection by this check.
What happened
The WPO365 Login plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability. Its anti-replay check in the SAML message ID handling never persists processed message IDs to storage because of a logic error that returns before saving. Attackers who capture a validly signed SAML response can replay it to the assertion consumer endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers. The issue is rated critical at CVSS 4.0 9.1.
WPO365 Login connects WordPress sites to Microsoft 365 sign-on, so a replayed administrator session means full control of the WordPress site.
What to do
- Inventory WordPress sites running the WPO365 Login plugin and check their version.
- Upgrade the plugin to version 45.2 or later.
- Review sign-on logs for repeated use of the same SAML message ID or logins that do not match normal user patterns.
- If a replay is suspected, force password resets and revoke sessions for affected accounts, starting with administrators.
- Confirm the deployed plugin version after updating.
Management note
This flaw turns one captured login into repeatable administrator access, and the safety check meant to stop it was silently non-functional. For sites using Microsoft 365 single sign-on, this is an upgrade-first item, followed by a log review for reused assertions.