What’s Vulnerable › Vulnerabilities

CVE-2020-26511

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-10-02 · updated 2026-06-17
• Weakness: CWE-287

Description

The wpo365-login plugin before v11.7 for WordPress allows use of a symmetric algorithm to decrypt a JWT token. This leads to authentication bypass.

Affected products

• wpo365.com WordPress + Microsoft Office 365 / Azure AD | LOGIN: before 11.7 — fixed in 11.7

How to fix

Upgrade to a fixed version: wpo365.com WordPress + Microsoft Office 365 / Azure AD | LOGIN 11.7. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset/2388992/
• https://wordpress.org/plugins/wpo365-login/#developers
• https://wpvulndb.com/vulnerabilities/10418
• https://www.wpo365.com/change-log/
• https://plugins.trac.wordpress.org/changeset/2388992/
• https://wordpress.org/plugins/wpo365-login/#developers
• https://wpvulndb.com/vulnerabilities/10418
• https://www.wpo365.com/change-log/

Get alerted when CVE-2020-26511 or the next vulnerability affects your stack