Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVE wpo365: authentication bypass in SAML login via replay (CVE-2026-122220) Remote attackers can reuse a captured SAML login response to log in as any victim, including administrators. Patch → 45.2 https://cve.now/CVE-2026-122220?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
🔴 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION…: WPO365 LOGIN before 45.2 SAML Replay Protection Bypass (CVE-2026-122220) Fix → 45.2 https://agentprime.io/advisories/CVE-2026-122220/