All-in-One Microsoft 365 & Entra ID/Azure AD SSO Login Authentication Bypass Vulnerability

A vulnerability allowing authentication bypass has been identified in the All-in-One Microsoft 365 & Entra ID/Azure AD SSO Login plugin for WordPress, affecting all versions through 2.2.5. This vulnerability enables unauthenticated attackers to bypass authentication mechanisms and log in as other users, including those with administrative privileges.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling attackers to log in as other users, potentially including administrators.

Remediation

Users are advised to update the plugin to version 2.2.6 or a newer patched version.