WordPress Plugin Vulnerabilities

WordPress + Microsoft Office 365 < 11.7 - JWT Signature Verification Bypass

Description

The plugin does not correctly verify JWT signatures, allowing attackers to forge tokens and bypass authentication and authorisation checks.

Affects Plugins

Plugin icon
wpo365-login
Fixed in 11.7

References

CVE
CVE-2020-26511
URL
https://www.wpo365.com/change-log/

Miscellaneous

Original Researcher
Philip Åkesson
Submitter
Philip Åkesson
Submitter website
https://www.truesec.com
Verified
No
WPVDB ID
c0433e94-3bcc-438a-9369-2607aec8b067

Timeline

Publicly Published
2020-10-02 (about 5 years ago)
Added
2020-10-02 (about 5 years ago)
Last Updated
2020-10-04 (about 5 years ago)

Other

Published
Title
Published
2015-06-26
Title
Multiple Themes - Privilige Escalation
Published
2017-07-25
Title
Stop User Enumeration <= 1.3.8 - REST API Bypass
Published
2019-07-10
Title
Hybrid Composer <= 1.4.6 - Unauthenticated Options Update
Published
2024-03-29
Title
VS Contact Form < 14.8 - CAPTCHA Bypass
Published
2023-10-03
Title
Captcha/Honeypot for Contact Form 7 < 1.11.4 - Captcha Bypass