high7.5
CVE-2020-26511
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token.
Impact
The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wpo365 | Wordpress \+ Azure Ad \/ Microsoft Office 365 | before 11.7 |
Weakness classification
References
- NVD record
- CVE.org record
- https://plugins.trac.wordpress.org/changeset/2388992/
- https://wordpress.org/plugins/wpo365-login/#developers
- https://wpvulndb.com/vulnerabilities/10418
- https://www.wpo365.com/change-log/
- https://plugins.trac.wordpress.org/changeset/2388992/
- https://wordpress.org/plugins/wpo365-login/#developers
- https://wpvulndb.com/vulnerabilities/10418
- https://www.wpo365.com/change-log/