CVE-2026-104759 in WPO365 Plugin
Summary
by MITRE • 10/10/2026
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION plugin for WordPress contains a critical authentication bypass vulnerability affecting all versions up to and including 44.1. This flaw, specifically identified as an Authentication Bypass via OIDC Nonce Replay, stems from a fundamental implementation error in the deprecated token processing logic. The vulnerability allows unauthenticated attackers who possess a previously issued but still valid OpenID Connect id_token for a target account to replay that token and authenticate as any WordPress user, including administrators. This capability results in full site takeover, granting the attacker complete control over the WordPress installation and its associated data.
The technical root cause lies within the `Id_Token_Service_Deprecated::process_openidconnect_token()` function, which is invoked when the plugin option `use_id_token_parser_v2` is enabled. During this process, the code attempts to validate a nonce value using the standard WordPress core function `wp_verify_nonce()`. However, the nonce generated by `Nonce_Service::create_nonce()` is formatted as a 64-character hexadecimal string. The `wp_verify_nonce()` function expects nonces in a specific format that includes numeric components and timestamps for time-based expiration checks. Because of this incompatibility, `wp_verify_nonce()` consistently fails to verify the hex-formatted nonce correctly. Crucially, instead of throwing an exception or halting execution upon verification failure, the code allows authentication to proceed silently. This design flaw means the security check is effectively bypassed without triggering any error logs that might alert administrators to the intrusion attempt.
From a threat modeling perspective, this vulnerability aligns with CWE-287: Improper Authentication and CWE-345: Insufficient Verification of Data Authenticity. The failure to properly validate the cryptographic nonce allows an attacker to reuse tokens that should have been invalidated or rendered unusable after their initial use. In terms of the MITRE ATT&CK framework, this behavior corresponds to T1078: Valid Accounts and potentially T1528: Steal Application Access Token if the token was obtained through prior compromise or interception. The exploitation requires no special privileges initially; an attacker merely needs to obtain a valid id_token for a target account, which can be achieved through phishing, session hijacking, or other credential theft techniques common in enterprise environments using Microsoft Azure AD integration.
The operational impact of this vulnerability is severe due to the potential for privilege escalation and complete system compromise. Since the authentication bypass works regardless of the user role specified during the token parsing process, an attacker can target high-privilege accounts such as administrators. Once authenticated via the replayed id_token, the attacker gains full access to the WordPress dashboard, allowing them to modify site settings, install malicious plugins, exfiltrate sensitive data stored in the database, or deface the website. The silent nature of the failure means that traditional security monitoring tools may not immediately flag this activity as anomalous unless specific audit logging for OIDC token validation failures is explicitly configured and monitored.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective solution is to update the WPO365 plugin to a version newer than 44.1, where the deprecated parser has been removed or fixed to use compatible nonce verification methods. If updating is not immediately possible, administrators should disable the `use_id_token_parser_v2` option within the plugin settings to prevent execution of the vulnerable code path. Additionally, organizations should enforce strict token expiration policies and implement monitoring for unusual authentication patterns, such as repeated login attempts from different IP addresses using the same user account. Regular audits of third-party plugins are essential to ensure that integration points with identity providers like Microsoft Azure AD remain secure against evolving attack vectors targeting OIDC implementations.