{"vulnerability": "CVE-2026-104759", "sightings": [{"uuid": "be0f1d00-8129-4cca-9c9c-0c6480678825", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104759", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117415547249000239", "content": "CVE-2026-104759 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Verification The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all versions up to, and including, 44.1 This is due to `Id_Token_Service_Deprecated::process_openidconnect_token()` using the incompatible WordPress core `wp_verify_nonce()` function to validate a nonce produced by `Nonce_Service::create_nonce()` \u2014 a 64-character hex value that `wp_verify_nonce()` can never successfully verify \u2014 causing the nonce check to silently fail without terminating authentication, so execution continues into `authenticate_oidc_user()` with the attacker-supplied `id_token`. This makes it possible for unauthenticated attackers who have obtained a previously-issued, valid `id_token` for a target account to replay that token and authenticate as any WordPress user, including administrators, resulting in full site takeover. This vulnerability is only exploitable when the `use_id_token_parser_v2` plugin option is enabled, as this is the configuration that routes token processing through the deprecated parser containing the broken nonce check.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104759https://www.wordfence.com/threat-intel/vulnerabilities/id/aad7ddac-ed12-4263-8e68-64b1fca8dfad?source=cvehttps://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Id_Token_Service_Deprecated.php#L110https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Router_Service.php#L275https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Id_Token_Service.php#L107https://plugins.trac.wordpress.org/browser/wpo365-login/tags/44.1/Services/Nonce_Service.php#L72https://plugins.trac.wordpress.org/changeset/3727410/wpo365-loginhttps://plugins.trac.wordpress.org/changeset?reponame=&new=3727410%40wpo365-login%2Ftags%2F45.0&old=3682496%40wpo365-login%2Ftags%2F44.1#wordpress #wpo365 #WPO365|SEAMLESSWORDPRESS+MICROSOFTINTEGRATION(WPO365|LOGIN)#CVE_2026_104759#bot", "creation_timestamp": "2026-10-10T07:57:48.647869Z"}, {"uuid": "6be501ad-3add-43fa-93ef-b144d4542d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104759", "type": "seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mxjbgjxj4u2t", "content": "WPO365 plugin fixes two flaws through 44.1:\n\u2022 CVE-2026-104759 (CVSS 8.1) auth bypass\n\u2022 CVE-2026-96765 (CVSS 7.2) stored XSS\nUpdate to 45.0 now.\n\nhttps://thecircuitry.to/article/wpo365-plugin-patches-two-high-severity-wordpress-flaws-mv24n75h", "creation_timestamp": "2026-10-10T10:22:55.242464Z"}, {"uuid": "64c612e2-0dc0-4cd9-bb07-7e9ebc585282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-104759", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxkawezvxr2g", "content": "\ud83d\udfe0 CVE-2026-104759 - High (8.1)\n\nThe WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-104759/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-10T19:46:32.360499Z"}]}