The WPO365 | Login plugin suffers from a Cross‑Site Request Forgery flaw that bypasses nonce verification. An attacker can send a forged POST to the wp_ajax_wpo365_update_settings endpoint, delivering a base64‑encoded JSON payload of plugin options. The endpoint merges all submitted keys into the global wpo365_options array without a whitelist, allowing an unauthenticated user to overwrite arbitrary settings, such as enabling the SCIM REST endpoint, inserting a known scim_secret_token, and setting new_usr_default_role to administrator. This flaw enables privilege escalation to full site administration.

All WordPress installations that use the WPO365 | Seamless WordPress + Microsoft Integration (Login) plugin with version 43.2 or older are affected, regardless of the WordPress core version. Sites running newer plugin releases are not impacted.

The vulnerability has a CVSS score of 8.8, indicating high severity. The EPSS score is less than 1 %, which suggests a low probability of exploitation at the moment, but the attack vector is simple: a cross‑origin POST that an administrator might trigger through a malicious link. The issue is not listed in CISA’s KEV catalog, so widespread exploit code may not yet exist, yet the potential for full administrative takeover warrants treating it with the same priority as a remote code execution risk.