CVE-2026-15212

Name of the Vulnerable Software and Affected Versions WPO365 | Login versions prior to 43.3

Description The plugin is susceptible to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a victim into performing actions they did not intend to. This occurs because the Ajax Service::verify ajax request() helper fails to execute the wp verify nonce() call due to the enable nonce check boolean option being absent from the default wpo365 options array, causing it to evaluate as false via get global boolean var(). Consequently, the wp ajax wpo365 update settings handler (specifically the Ajax Service::update settings function) accepts POST requests from cross-origin pages. These requests forward a base64/JSON settings payload to Options Service::update options(), which merges the data into wpo365 options without a key allowlist. Unauthenticated attackers can exploit this to overwrite arbitrary plugin options, such as enabling the SCIM REST endpoint via enable scim, injecting a scim secret token, or changing the new usr default role to administrator.

Recommendations Update the plugin to a version newer than 43.2.