---
id: CVE-2026-122220
title: WPO365 LOGIN before 45.2 SAML Replay Protection Bypass
summary: >-
  WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an
  authentication bypass by capture-replay vulnerability caused by a
  non-functional anti-replay check in Saml2_Service::check_message_id(), which
  never persists processed …
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-294
vendor: wpo365
product: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
affected:
  - seamless_wordpress_+_microsoft_integration_wpo365_login < 45.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-05T19:14:57.528334Z'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:15:13.912Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122220'
references:
  - url: 'https://wordpress.org/plugins/wpo365-login/#developers'
    label: Vendor Patch
  - url: 'https://plugins.trac.wordpress.org/changeset/3783469/'
  - url: >-
      https://www.vulncheck.com/advisories/wpo365-login-before-saml-replay-protection-bypass
    label: 'VulnCheck Advisory: WPO365 LOGIN before 45.2 SAML Replay Protection Bypass'
tags:
  - cve.org
epss: 0.00329
epssPercentile: 0.2618
ingestedAt: '2026-11-05T22:38:31.518Z'
---

## Overview

WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.

## Affected

- `seamless_wordpress_+_microsoft_integration_wpo365_login < 45.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.