Skip to content
[CVE-2026-2628] Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation
yeswehack.com | vulnerability | Critical | CVE-2026-2628 | #cloud | #authentication-bypass | #wordpress | #sso | #oidc | #azure-ad | #cve-2026-2628
Summary
CVE-2026-2628 (CVSS 9.8): missing id_token validation in a WordPress Entra ID/Azure AD SSO plugin let unauthenticated attackers sign in as any user, including admins — root cause, PoC, mitigation.
- CVSS
- 9.8
- Published
- Collected