PT-2026-22714 · Microsoft+1 · 365+3

Nabil Irawan · Published 2026-03-03 · Updated 2026-04-11 · CVE-2026-2628

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress versions through 2.2.5

Description The All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin for WordPress is susceptible to an authentication bypass, allowing unauthenticated attackers to log in as other users, including administrators. This could lead to a full site compromise.

Recommendations Update the plugin immediately once a fixed version is available. Review admin accounts and login activity for anomalies. Scan the site for signs of post-compromise persistence.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2026-2628

Affected Products

All-In-One Microsoft 365 & Entra Id / Azure Ad Sso Login

Azure Ad

Entra Id

365

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-2628 · Security Note
• https://twitter.com/TheHackerWire/status/2028738779356495989 · Twitter Post
• https://twitter.com/CveFindCom/status/2028662030593380699 · Twitter Post
• https://twitter.com/UndercodeUpdate/status/2042794429950382375 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028684585026941018 · Twitter Post
• https://plugins.trac.wordpress.org/browser/login-with-azure?rev=3465063 · Note
• https://twitter.com/MNovofastovsky/status/2035280254139265094 · Twitter Post
• https://twitter.com/yeswehack/status/2042509778916905114 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5e15e36e-55f9-4095-a0ba-48ef9434606a?source=cve · Note
• https://t.me/cveNotify/153883 · Telegram Post
• https://twitter.com/CVEnew/status/2028683869243990452 · Twitter Post
• https://t.me/CVEtracker/46181 · Telegram Post