A WPO365 Login vulnerability affects WordPress sites that let employees sign in with a Microsoft 365 account. It is rated 9.1 out of 10 on the NVD listing, and updating to version 45.2 or later is the step to take now.
What is it?
A flaw lets someone reuse an already valid login credential to sign into a WordPress site as someone else, including an administrator, without the system noticing.
The vulnerability carries the identifier CVE-2026-122220. It affects a check meant to stop the same login credential from being used twice: the check exists, but it does not keep track of what has already been used. Picture the attendant at the arena gate who examines every ticket, confirms it’s genuine, but never punches it. The same ticket can be used again and again all night. Here, during the short window while the login credential stays valid, anyone who intercepted it can use it to open a session as if it were yours.
Why is it serious?
The flaw allows impersonation of any account whose valid login credential has been obtained, including an administrator account. The NVD listing reports no exploitation to date.
The NVD listing publishes two scores, both assigned by the reporting organization (CNA): 9.1 out of 10 under CVSS 4.0 and 7.4 out of 10 under CVSS 3.1. CVSS is a method for rating the severity of a vulnerability; these two figures correspond to two versions of that method, and neither measures how often attacks actually occur. Both point to a serious flaw. Published on November 4, 2026, the listing reports no observed exploitation. That is good news, not a reason to wait: the fix is public, and a public fix also tells curious people where to look. If an administrator account falls into the wrong hands, the possible consequences range from a site altered or taken offline to customer information accessed or copied. A service outage and calls to make to your customers are among the possible follow-ups; a compromise does not automatically lead to all of these outcomes.
Who is affected?
WordPress sites running the WPO365 | LOGIN extension from publisher wpo365 in a version earlier than 45.2.
The affected product is WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN), published by wpo365. All versions before 45.2 are affected; 45.2 fixes the flaw, confirmed by a change published in the official WordPress plugin repository. The extension is used to sign into the site with the company’s Microsoft 365 credentials. Organizations potentially affected are therefore those that already use Microsoft 365 at the office and wanted to avoid a second password for the site: professional firms, clinics, manufacturers with a client portal, nonprofits, retailers. These sectors are examples; the published material does not document who actually uses the extension.
How do I check my business?
The WordPress dashboard shows whether the extension is installed and which version is running.
- Open the Plugins section of the WordPress dashboard and note whether WPO365 | LOGIN is installed, and in which version (management or the person who administers the site).
- Compare that version against 45.2, then apply the fix after a full site backup (IT provider or website vendor).
- Review the list of administrator accounts and recent logins to spot any unusual access (IT provider).
- Get written confirmation that the fix is installed. Also ask about the state of multi-factor authentication on administrator access, meaning a second proof of identity beyond the password (management, with the software or website vendor).
Scenario
Fictional example: a dental clinic whose website never received the fix for its login extension.
The site handles appointment booking and automated reminders, and no one has looked after the extensions since the technician who built the site left. One morning, the homepage shows text the clinic never wrote, and the appointment form stops responding. The receptionist spends the day confirming appointments one by one, and regaining control of the administrator accounts has to wait for the provider’s availability. A full day of work is gone, and patient trust rebuilds more slowly than a website does.
What to do now
- Check today whether the WPO365 | LOGIN extension is present on your site and which version it’s running.
- Back up the entire site, then install version 45.2 or later.
- Disable the extension if your site doesn’t use single sign-on with Microsoft 365.
- Review administrator accounts and recent logins, and remove access that is no longer needed.
- Turn on multi-factor authentication for every administrator account on the site.
What the WPO365 Login vulnerability means for a local business
In Quebec, a website that hosts customer contact details falls under the Act respecting the protection of personal information in the private sector (Law 25): a privacy incident register and notice to the Commission d’accès à l’information (Quebec’s access-to-information and privacy regulator) are required when an incident poses a risk of serious injury. Fixing a vulnerable extension is therefore not just an IT task, it is a governance measure. The Canadian Centre for Cyber Security also lists patching and multi-factor authentication among its baseline controls for small and medium organizations. No protection is absolute, and no provider can guarantee zero risk; these two controls still sharply reduce exposure.
FAQ
My site is small, does anyone really care?
Size is not a shield. The material published on this flaw says nothing about how vulnerable sites might be identified, and we won’t speculate. The broader context is clear enough: the Canadian Centre for Cyber Security directs its baseline controls at small and medium organizations. Applying available fixes remains the simplest step, regardless of the site’s size.
The listing says no attacks have been observed, can I wait?
We don’t recommend it. The NVD listing from November 4, 2026 reports no exploitation, which describes the present, not next week. The fix is already public: better to install it while there’s no urgency, the way you’d close up the cottage before the first storm rather than during it.
Who should handle this at our company?
Management decides and sets the deadline; execution falls to the person or firm that manages the site. If no one internally owns this, write to your website provider and ask for the installed version, the date the fix was applied, and the state of multi-factor authentication on administrator accounts. Keep the reply on file: it documents your due diligence.
Sources
- CVE-2026-122220 listing, National Vulnerability Database · NIST, November 4, 2026
- Security advisory (plugins.trac.wordpress.org) · plugins.trac.wordpress.org
- Canadian Centre for Cyber Security: baseline cybersecurity controls for small and medium organizations · baseline control checklist
- Commission d’accès à l’information du Québec · obligations, incident register, and notification
Source: NVD (NIST) · https://nvd.nist.gov/vuln/detail/CVE-2026-122220
Article prepared by RISS Canada’s threat monitoring team from the public sources cited above, with the assistance of artificial intelligence tools, then reviewed under our editorial charter.
