CVE-2020-26511: 
WordPress vulnerability analysis and mitigation

The wpo365-login plugin before version 11.7 for WordPress contained a vulnerability that allowed the use of a symmetric algorithm to decrypt a JWT token, leading to authentication bypass. The vulnerability was discovered and disclosed in October 2020 (NVD, CVE).

The vulnerability was assigned CVE-2020-26511 with a CVSS v3.1 Base Score of 7.5 (HIGH). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N) or user interaction (UI:N), and affects only the integrity of the system (C:N/I:H/A:N) (NVD).

The vulnerability could allow attackers to bypass authentication mechanisms by exploiting the weak JWT token decryption implementation. This could potentially give unauthorized users access to protected WordPress resources (NVD).

The vulnerability is relatively easy to exploit as it requires no special privileges or user interaction. The attack can be conducted remotely over the network with low complexity (NVD).

The vulnerability was patched in version 11.7 of the wpo365-login plugin. Users should update to this version or later to mitigate the risk. The update removed support for symmetric algorithms to decrypt JWT tokens (WPO365 Changelog).