CVE-2026-104759

Deferred Deferred - Pending Action

Authentication Bypass via OIDC Nonce Replay in WPO365 WordPress Plugin

Publication date: 2026-10-10

Last updated on: 2026-10-11

Assigner: Wordfence

Description

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` — a 64-character hex value that `wp_verify_nonce()` can never successfully verify — causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-11

Generated

2026-10-19

AI Q&A

2026-10-10

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104759

EUVD

EUVD-2026-96286

Affected Vendors & Products

Vendor	Product	Version / Range
wpo365	WPO365	\| SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 \| LOGIN) 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an Authentication Bypass via OIDC Nonce Replay in the WPO365 plugin for WordPress. It occurs because the plugin uses an incompatible nonce verification method that fails to validate tokens properly. Attackers can replay a valid token to gain unauthorized access, including admin privileges, if the vulnerable configuration option is enabled.

Detection Guidance

Check if the WPO365 plugin is installed and verify its version. Look for unusual authentication logs or repeated successful logins with the same token. Inspect WordPress configuration for the use_id_token_parser_v2 option enabled.

Impact Analysis

Unauthenticated attackers can exploit this to gain full control of a WordPress site by replaying a valid token. This includes accessing admin accounts, modifying site content, stealing data, or installing malicious software. The impact is severe as it allows complete site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Disable the use_id_token_parser_v2 option in the WPO365 plugin settings. Update the plugin to the latest version if available. Review and revoke any potentially compromised tokens or user sessions.

Hi! I’m here to help you understand CVE-2026-104759. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70