Curated security research, vulnerabilities, advisories and tools for practitioners.

← back | CVE Intelligence

CVE-2026-2628 [Critical]

Curated 1 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-2628.

CVSS: 9.8
Coverage Span: 2026-04-10
Reports: 1 related reports

Associated Reports & Timeline

Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation

CVE-2026-2628 (CVSS 9.8): missing id_token validation in a WordPress Entra ID/Azure AD SSO plugin let unauthenticated attackers sign in as any user, including admins — root cause, PoC, mitigation.