CVE-2026-122220 WPO365 LOGIN before 45.2 SAML Replay Protection Bypass
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122220?
CVE-2026-122220 is a critical vulnerability in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN), published on 4 Nov 2026.
Official description
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Weakness: CWE-294
Which versions are affected by CVE-2026-122220?
How do I fix CVE-2026-122220?
No fix has been published for CVE-2026-122220 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122220 being exploited?
There is no known exploitation of CVE-2026-122220 in the wild and no public exploit code.
Sources
Also known as GHSA-72vv-ff63-gjjc.