CVE-2026-104759

Summary

The WPO365 plugin contains a critical authentication bypass vulnerability where attackers can replay valid OpenID Connect ID tokens to impersonate any user, including administrators, due to a nonce verification flaw that silently fails during authentication.

Exploitability

Exploitation requires an attacker to obtain a valid id_token from a target account and ensure the 'use_id_token_parser_v2' option is enabled, making it moderately difficult but possible to achieve full site takeover.

Blast radius

If exploited, this vulnerability could lead to complete compromise of WordPress sites using the affected plugin, allowing attackers to gain administrative control over user accounts and potentially access sensitive data or modify site content.

Detection

Monitor for failed authentication attempts followed by successful authentications using previously valid tokens, particularly in authentication logs where nonce verification failures occur silently.

Prioritized remediation

Disable the 'use_id_token_parser_v2' option immediately or upgrade to version 44.2 or later if available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.