CVE-2026-122220: WPO365 LOGIN before 45.2 SAML Replay Protection Bypass
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2Service::checkmessageid(), which never persists processed SAML message IDs to the wpo365samlmessageids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wpo365-loginto a version that resolves this vulnerability.Fixed in 45.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the WPO365 | LOGIN plugin before version 45.2 are exposed when an attacker can capture a validly signed SAMLResponse for a user. The replay can authenticate as that user, including an administrator.
What does an attacker need to exploit it?
The attacker needs a captured validly signed SAMLResponse and must replay it to the ACS endpoint while the assertion remains valid. No prior authentication or user interaction is required.
Are repeated replays detected by the plugin?
No. The affected anti-replay check does not persist processed SAML message IDs, so duplicate message IDs do not trigger detection.
What version addresses the issue?
Version 45.2 is the first version stated as not affected. Upgrade from any earlier version.