CVE-2026-2628

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2628", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-17T13:25:58.536Z", "datePublished": "2026-03-03T01:21:49.975Z", "dateUpdated": "2026-04-08T16:56:07.725Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:07.725Z"}, "affected": [{"vendor": "cyberlord92", "product": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators."}], "title": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e15e36e-55f9-4095-a0ba-48ef9434606a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/login-with-azure?rev=3465063"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "timeline": [{"time": "2026-02-05T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-02-17T13:41:28.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-02T13:04:58.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-03T16:23:20.381564Z", "id": "CVE-2026-2628", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T16:23:30.801Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2628", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-03T16:23:20.381564Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-03T16:23:25.606Z"}}], "cna": {"title": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "cyberlord92", "product": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-05T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-02-17T13:41:28.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-02T13:04:58.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e15e36e-55f9-4095-a0ba-48ef9434606a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/login-with-azure?rev=3465063"}], "descriptions": [{"lang": "en", "value": "The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:56:07.725Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2628", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:56:07.725Z", "dateReserved": "2026-02-17T13:25:58.536Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-03T01:21:49.975Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login", "vendor": "cyberlord92", "versions": [{"lessThanOrEqual": "2.2.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators."}, {"lang": "es", "value": "El plugin All-in-One Microsoft 365 &amp; Entra ID / Azure AD SSO Login para WordPress es vulnerable a la omisi\u00f3n de autenticaci\u00f3n en todas las versiones hasta la 2.2.5, inclusive. Esto permite que atacantes no autenticados omitan la autenticaci\u00f3n e inicien sesi\u00f3n como otros usuarios, incluidos los administradores."}], "id": "CVE-2026-2628", "lastModified": "2026-06-17T10:31:25.693", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2628", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-03T16:23:20.381564Z", "version": "2.0.3"}}]}, "published": "2026-03-03T02:16:10.873", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/login-with-azure?rev=3465063"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5e15e36e-55f9-4095-a0ba-48ef9434606a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.2.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login", "source": "cna", "vendor": "cyberlord92"}, "product": "all-in-one_microsoft_365_&_entra_id_/_azure_ad_sso_login", "vendor": "cyberlord92"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T17:59:23.094732+00:00", "value": {"mitigation_remediation": ["Apply the latest plugin release that addresses the authentication bypass; the vendor has issued a patch that corrects the login handler. ", "If an immediate update is not feasible, disable the All\u2011In\u2011One Microsoft\u202f365 & Entra ID / Azure AD SSO Login plugin entirely until the fix can be applied. ", "Configure the web server or firewall to block unauthenticated requests to the plugin\u2019s authentication endpoint, effectively preventing the bypass until the plugin is updated or removed."], "summary": {"action": "Immediate Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Cyberlord92 All\u2011In\u2011One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress. All releases through and including version 2.2.5 are impacted, and any site that has not yet updated to a newer version is potentially exposed.", "description_and_impact": "The All\u2011In\u2011One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress allows an unauthenticated attacker to bypass normal login checks and authenticate as any account, including site administrators. This vulnerability can be exploited simply by sending a crafted request to the plugin\u2019s authentication endpoint, resulting in unauthorized disclosure of administrative privileges and the potential to modify content, install malware, or compromise the entire site. The flaw is consistent with CWE\u2011288, a failure to verify the authenticity of credentials.", "risk_and_exploitability": "With a CVSS score of 9.8 the flaw is considered critical, yet its EPSS score indicates a very low probability of exploitation at this time (<1\u202f%). The plugin is not listed in the CISA KEV catalog. The most likely attack vector is over the web; an attacker only needs unauthenticated access to the site\u2019s login interface, making the exploitation straightforward for anyone who can reach the affected WordPress instance."}}}}, "created": "2026-03-04T14:54:37.523063+00:00", "updated": "2026-04-15T18:00:15.510801+00:00", "vendors": ["cyberlord92", "cyberlord92$PRODUCT$all-in-one_microsoft_365_&_entra_id_/_azure_ad_sso_login", "wordpress", "wordpress$PRODUCT$wordpress"]}