CVE-2026-2628 PUBLISHED

All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= 2.2.5 - Authentication Bypass

Assigner: Wordfence
Reserved: 17.02.2026 Published: 03.03.2026 Updated: 03.03.2026

The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.2.5. This makes it possible for unauthenticated attackers to bypass authentication and log in as other users, including administrators.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor cyberlord92
Product All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login
Versions Default: unaffected
  • affected from * to 2.2.5 (incl.)

Credits

  • Nabil Irawan finder

References

Problem Types

  • CWE-288 Authentication Bypass Using an Alternate Path or Channel CWE