CVE-2026-104759

Name of the Vulnerable Software and Affected Versions WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION versions prior to 44.2

Description An authentication bypass exists due to an OIDC Nonce Replay flaw. The Id Token Service Deprecated::process openidconnect token() function uses the wp verify nonce() function to validate a nonce created by Nonce Service::create nonce(). Because the created nonce is a 64-character hex value that wp verify nonce() cannot verify, the check fails silently and allows execution to proceed to authenticate oidc user() using an attacker-supplied id token. This allows unauthenticated attackers with a previously issued valid id token to replay it and authenticate as any user, including administrators, leading to full site takeover. This issue is only exploitable when the use id token parser v2 plugin option is enabled.

Recommendations Update the plugin to a version later than 44.1. Disable the use id token parser v2 plugin option to prevent the use of the deprecated parser containing the flawed nonce check.