External risk intelligence

WPO365 Login SAML Authentication Bypass by Replay

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-122220

The vulnerability exists in a WordPress login plugin that handles SAML-based authentication. Such plugins are designed to be public-facing by default, as they facilitate user access and identity management for web applications accessible over the internet.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The WPO365 | LOGIN plugin has a vulnerability that could allow unauthorized access by replaying a previously captured authentication message. This issue stems from an incomplete check that fails to prevent duplicate messages, potentially enabling attackers to log in as legitimate users, including administrators, without being detected.

Attackers can bypass login using repeated messages.
It impacts user access and administrative controls.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication by capturing and replaying a legitimate SAML response. This is possible because the plugin fails to properly record and check previously processed SAML message IDs, allowing a captured, validly signed SAML response to be used multiple times within its validity period. An attacker could exploit this to log in as any user, including administrators, without being detected.

Network exposure required.
Replay a captured SAML response.
Unauthorized administrator access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in a WordPress login plugin could allow attackers to bypass authentication by replaying captured SAML responses. When supported by the advisory, this could enable unauthorized access to the application and any associated data, including administrator accounts, by impersonating legitimate users within the validity window of a previously captured SAML assertion.

Unauthorized access to user accounts.
Replay of valid SAML responses.
Account takeover and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WPO365 | LOGIN plugin's authentication bypass vulnerability demands immediate attention from platform and security teams. The initial step is to identify all instances of the affected plugin, determine their exposure and business criticality, and pinpoint the accountable system owners to begin risk-based remediation planning.

Platform and security teams must own.
Verify plugin reachability and criticality first.
Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WPO365 | LOGIN plugin?

WPO365 | LOGIN is a WordPress plugin designed to simplify user authentication by integrating with external identity providers using the SAML protocol. It is commonly used by site administrators to enable Single Sign-On (SSO), allowing users to log into their WordPress environment using credentials managed by a central enterprise identity system.

What does CVE-2026-122220 mean?

This CVE identifies an authentication bypass vulnerability classified as CWE-294, which involves a failure to properly handle replay attacks. In simple terms, the plugin fails to remember if a specific SAML login message has already been used. Because the system does not track these messages, an attacker who captures a valid login response can reuse it to impersonate a legitimate user or administrator.

How does an attacker trigger this vulnerability?

An attacker needs to capture a legitimate, signed SAMLResponse sent during a normal login process. Once captured, they can submit this exact same message to the plugin's ACS endpoint repeatedly. The bug is triggered because the plugin's security logic returns an error or exits before saving the message ID, meaning it never performs the necessary check to see if the message has been seen before.

Is my site at risk according to Halo Surface Signal?

Yes, Halo Surface Signal flags this as 'Very likely' because the affected component handles authentication for web applications. Since this plugin is specifically designed to facilitate login processes, it is inherently internet-facing by default, making it accessible to any attacker capable of reaching your WordPress login endpoint over the network.

How should I respond to this vulnerability?

First, verify if your WordPress installation is running a version of the WPO365 | LOGIN plugin older than 45.2. If you are running an affected version, coordinate with your technical team to prioritize an update. Your goal is to reach a patched state where the SAML message ID persistence logic functions correctly, preventing the reuse of captured authentication assertions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.