CVE-2026-15212— WPO365 | LOGIN 跨站请求伪造漏洞

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update

The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

跨站请求伪造(CSRF)

WPO365 | LOGIN 跨站请求伪造漏洞

wpo365 WPO365 | LOGIN是wpo365个人开发者的一款适用于 WordPress 的微软账号单点登录（SSO）及集成插件。 WPO365 | LOGIN 43.2及之前版本存在跨站请求伪造漏洞，该漏洞源于Ajax_Service::verify_ajax_request()帮助程序中的wp_verify_nonce()调用被' enable_nonce_check '布尔选项门控，导致未经身份验证的攻击者通过伪造请求覆盖任意插件选项。

N/A

N/A