CVE-2026-2628: 
WordPress vulnerability analysis and mitigation

CVE-2026-2628 is an authentication bypass vulnerability in the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress, affecting all versions up to and including 2.2.5. It allows unauthenticated remote attackers to bypass authentication and log in as arbitrary users, including administrators, without valid credentials. The vulnerability was published on March 3, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence, ENISA EUVD).

The root cause is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel, meaning the plugin fails to properly enforce authentication controls, allowing an attacker to reach privileged functionality through an alternate code path or channel without supplying valid credentials. The attack vector is network-based, requires no privileges, no user interaction, and has low attack complexity — making it trivially exploitable by any unauthenticated remote attacker. A public proof-of-concept (PoC) was published on GitHub shortly after disclosure (PoC GitHub, Wordfence). The plugin's SSO login flow — which integrates with Microsoft 365 / Entra ID / Azure AD — appears to contain the flawed authentication logic (WordPress Plugin Trac).

Successful exploitation grants an unauthenticated attacker full access to any WordPress user account, including administrator accounts, without knowing any credentials. This can lead to complete site compromise: attackers may steal sensitive data, inject malicious code (e.g., backdoors or malware), deface the site, create rogue admin accounts, or pivot to underlying server infrastructure. The CVSS score reflects high impact across confidentiality, integrity, and availability (Wordfence, UndercodeTesting).

A public PoC exploit is available on GitHub (published March 3, 2026), lowering the barrier for exploitation significantly (PoC GitHub). As of the time of reporting, there is no confirmed evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.296%, indicating a currently low but non-negligible probability of exploitation in the near term (Feedly). The vulnerability is detectable by Qualys (detection ID: 531039) (Qualys).

1. Reconnaissance: Identify WordPress sites using the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin (versions ≤ 2.2.5) via passive scanning tools (e.g., WPScan, Shodan, or Google dorks such as inurl:wp-content/plugins/login-with-azure).
2. Identify the SSO login endpoint: Locate the plugin's SSO authentication callback or login endpoint, typically accessible at a URL like /wp-login.php?action=azure_sso or a similar plugin-registered route.
3. Trigger the alternate authentication path: Using the public PoC (PoC GitHub), craft a request that exploits the alternate authentication channel (CWE-288) — bypassing credential validation by manipulating SSO callback parameters or session state without a valid Microsoft identity token.
4. Specify target user: Supply the username or user identifier of the target account (e.g., an administrator) in the crafted request to authenticate as that user.
5. Achieve authenticated session: The server issues a valid WordPress session cookie for the targeted user, granting full access to the WordPress dashboard and all associated privileges.
6. Post-exploitation: With administrator access, install malicious plugins, create backdoor accounts, exfiltrate data, or modify site content (Wordfence, UndercodeTesting).

• Network: Unusual or repeated HTTP requests to the plugin's SSO callback/login endpoint (e.g., URLs containing login-with-azure, azure_sso, or similar plugin-specific paths) from unexpected IP addresses or without a preceding Microsoft OAuth redirect flow.
• Logs: WordPress authentication logs (wp-login.php access logs) showing successful logins for administrator accounts from unfamiliar IPs or at unusual times, without corresponding Microsoft identity provider referrer headers; web server access logs showing requests to SSO endpoints with anomalous or missing OAuth state/token parameters.
• File System: Newly installed or modified WordPress plugins or themes post-compromise; presence of PHP web shells in the wp-content/uploads/ or plugin directories; new or modified wp-config.php.
• WordPress Admin: Unexpected new administrator user accounts; changes to site settings, installed plugins, or theme files; unfamiliar scheduled tasks (cron jobs) registered in WordPress.
• Process: Unusual child processes spawned by the web server process (e.g., curl, wget, bash) indicating post-exploitation activity.

Update the All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin to a version newer than 2.2.5 immediately, as the vendor has released a patched version (Wordfence, WordPress Plugin Trac). If an immediate update is not feasible, temporarily disable the plugin or restrict access to the WordPress installation via network-level controls (e.g., IP allowlisting). After patching, review all WordPress user accounts for unauthorized additions, reset credentials for all administrator accounts, and audit recent login activity for signs of prior compromise (Wordfence).

Wordfence, which assigned and disclosed the CVE, published a weekly WordPress vulnerability report covering this issue for the week of March 2–8, 2026 (Wordfence Blog). The vulnerability received coverage from security news outlets including The Hacker Wire and UndercodeTesting, the latter publishing a dedicated technical article highlighting the risk of full WordPress site takeover (UndercodeTesting). Social media discussion was observed on Bluesky and Mastodon/Infosec.exchange, with security researchers flagging the availability of a public PoC as a significant concern. The vulnerability was also featured in a bug bounty podcast episode discussing high-impact WordPress authentication bypass techniques (UndercodeTesting Podcast).