CVE-2026-2628: WordPress SSO Plugin Auth Bypass Flaw

CVE-2026-2628 Overview

The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress contains an authentication bypass vulnerability in all versions up to, and including, 2.2.5. This vulnerability makes it possible for unauthenticated attackers to bypass authentication mechanisms and log in as other users, including administrators, without providing valid credentials. This represents a severe security flaw in WordPress environments relying on Microsoft 365 and Azure AD single sign-on integration.

Critical Impact
Unauthenticated attackers can bypass authentication entirely and gain administrative access to WordPress sites, potentially leading to complete site compromise, data theft, and further malicious activities.

Affected Products

All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress versions ≤ 2.2.5
WordPress installations using the login-with-azure plugin for SSO authentication
Enterprise environments leveraging Microsoft 365 / Azure AD integration with WordPress

Discovery Timeline

2026-03-03 - CVE-2026-2628 published to NVD
2026-03-03 - Last updated in NVD database

Technical Details for CVE-2026-2628

Vulnerability Analysis

This vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The flaw exists in how the plugin validates authentication responses during the SSO login flow. Rather than properly verifying the authentication state through secure channels, the implementation contains a logic flaw that allows attackers to circumvent the intended authentication pathway entirely.

The authentication bypass affects all versions through 2.2.5, indicating a fundamental design issue in how user authentication is verified after the OAuth/OIDC flow with Microsoft identity services. Attackers can exploit this without any prior authentication, making it trivially accessible to external threat actors.

Root Cause

The vulnerability stems from improper validation of authentication tokens or session states during the SSO callback process. The plugin fails to adequately verify that authentication responses originate from legitimate Microsoft identity services and correspond to actual authenticated users. This allows attackers to craft or manipulate authentication requests to impersonate arbitrary users, including those with administrative privileges.

Attack Vector

The attack is network-accessible and requires no user interaction or prior privileges. An attacker can target any WordPress site running the vulnerable plugin version by:

Identifying WordPress installations using the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin
Crafting malicious authentication requests that exploit the bypass mechanism
Submitting these requests to the plugin's callback endpoint
Gaining access as any user, including administrators

The vulnerability can be exploited remotely without authentication, and successful exploitation grants full access to the WordPress installation with the privileges of the impersonated user.

Detection Methods for CVE-2026-2628

Indicators of Compromise

Unexpected administrative logins without corresponding Azure AD authentication events in Microsoft 365 audit logs
SSO callback endpoint receiving requests with anomalous or malformed parameters
New administrator accounts or privilege escalation occurring without legitimate user action
WordPress user session activity that does not correlate with Azure AD sign-in logs

Detection Strategies

Monitor WordPress authentication logs for logins that bypass Azure AD verification
Implement correlation between Microsoft 365 sign-in logs and WordPress SSO authentication events
Deploy web application firewall (WAF) rules to detect manipulation of SSO callback parameters
Review access logs for the plugin's authentication endpoints for unusual request patterns

Monitoring Recommendations

Enable detailed logging for WordPress authentication events and SSO plugin activity
Configure alerts for administrative logins, especially from unexpected IP addresses or geolocations
Implement real-time monitoring of user privilege changes within WordPress
Cross-reference WordPress authentication events with Azure AD audit logs for discrepancies

How to Mitigate CVE-2026-2628

Immediate Actions Required

Update the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin to a patched version immediately
Audit WordPress user accounts for unauthorized additions or privilege escalations
Review recent authentication logs for signs of unauthorized access
Consider temporarily disabling the SSO plugin until a patch can be applied if immediate update is not possible

Patch Information

Organizations should update to a patched version of the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin as soon as one becomes available. Monitor the WordPress Plugin Repository and the Wordfence Vulnerability Report for patch announcements and updated plugin releases.

Workarounds

Temporarily disable the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin and revert to WordPress native authentication
Implement IP allowlisting at the network level to restrict access to the WordPress admin panel
Deploy a web application firewall (WAF) with rules to block suspicious SSO callback requests
Enable multi-factor authentication through alternative means until the plugin is patched
Restrict administrative access to trusted networks using .htaccess or server-level access controls

bash

# Example: Restrict wp-admin access by IP in .htaccess
<Files wp-login.php>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>