Paper/Archive/CVE-2026-2628

CVE-2026-2628

cyberlord92 All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login — All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass

EPSS 1.0%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 62.0.620 × 2012.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators.

Affected

ProductAffectedFixed inSource

All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login≤ 2.2.5–CNA

Scores by source

Wordfence (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refwordfence.com/threat-intel/vulnerabilities/id/5e15e36e-55f9-4095-a0ba-48ef9434606a?source=cve refplugins.trac.wordpress.org/browser/login-with-azure?rev=3465063