WPO365 settings CSRF can establish an administrator provisioning path
WPO365 | Login through 43.2 exposes the authenticated wpo365_update_settings AJAX action to CSRF because Ajax_Service::verify_ajax_request() checks its nonce only when the normally absent enable_nonce_check option is true. A forged base64-encoded JSON settings value is merged into wpo365_options without a key allowlist, so an attacker who induces an administrator to submit the request can enable SCIM, choose the SCIM secret and set newly provisioned users to the administrator role.
- Component
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- Plugin slug
wpo365-login- Affected
- <= 43.2
- Safe version
43.3- Published
- Jul 23, 2026
This CVE was published Jul 23, 2026 and is one of 3 known issues for this plugin.
Update, patch or deactivate.
Update WPO365 | Login to 43.3 or later. The vendor fix makes the wpo365_fx_nonce check unconditional. If backporting, always reject the action unless wp_verify_nonce() succeeds and restrict update_options() to an explicit settings-key allowlist. Rotate any SCIM secret and review provisioned administrators if the vulnerable action may have been exposed.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H