PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-2628] Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation

yeswehack.com | vulnerability | Critical | CVE-2026-2628 | #cloud | #authentication-bypass | #wordpress | #sso | #oidc | #azure-ad | #cve-2026-2628
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-2628 (CVSS 9.8): missing id_token validation in a WordPress Entra ID/Azure AD SSO plugin let unauthenticated attackers sign in as any user, including admins — root cause, PoC, mitigation.
CVE
CVE-2026-2628
CVSS
9.8
Published
Collected

Related coverage

research · aretiq.ai
CVE-2026-61967 — miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypass
This research provides technical context that security teams can use for monitoring and validation.
blog · blog.viettelcybersecurity.com
Phát hiện lỗ hổng nghiêm trọng trong plugin WordPress của 400.000 website
Authentication bypass flaws in InfiniteWP Client, WP Time Capsule and WP Database Reset plugins exposed 400,000 WordPress sites to unauthenticated admin logins; patches were released.
vulnerability · bishopfox.com
[CVE-2026-67279] MikroTrick: Inside the RouterOS Takeover Chain
Bishop Fox reproduced the MikroTrick RouterOS takeover chain, using CVE-2026-67279 and a second flaw for unauthenticated admin access on 7.x, and confirmed real devices were already compromised.
vulnerability · bishopfox.com
CVE-2026-82329: Unauthenticated Administrative Access in JFrog Artifactory via an Empty Cluster Join Key
Bishop Fox on CVE-2026-82329: a default Artifactory cluster join key anyone can derive, so one forged join request mints an admin token — CVSS 9.8, KEV-listed, fixed in 7.111.21.
vulnerability · bishopfox.com
Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490
Bishop Fox maps NetScaler CVE-2026-19490, a CVSS 9.3 SAML bypass: one request runs post-login code, impact ranges from crash to internal proxy to root, plus a safe patch-state checker.
Critical · vulnerability · bishopfox.com
A Millisecond of Predictability: Why CVE-2026-11374 Is Hard to Exploit
The flaw can yield unauthenticated administrator takeover across four AD360-integrated ManageEngine products. Exploitation is targeted and timing-dependent, but the impact is critical.
Back