---
id: 4696
title: "[CVE-2026-2628] Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation"
cve: CVE-2026-2628
cvss: 9.8
severity: critical
source_domain: yeswehack.com
source_url: "https://www.yeswehack.com/news/auth-bypass-wordpress-azure-plugin"
published_at: "2026-04-10 07:36"
tags: ["cloud", "authentication-bypass", "wordpress", "sso", "oidc", "azure-ad", "cve-2026-2628"]
phying_url: "https://phying.com/item/4696"
lang: en
---

# [CVE-2026-2628] Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation

## Summary

CVE-2026-2628 (CVSS 9.8): missing id_token validation in a WordPress Entra ID/Azure AD SSO plugin let unauthenticated attackers sign in as any user, including admins — root cause, PoC, mitigation.

## Intelligence Metadata

- **Sources:** yeswehack.com
- **CVE:** CVE-2026-2628
- **CVSS:** 9.8
- **Published:** 2026-04-10 07:36
- **Original:** https://www.yeswehack.com/news/auth-bypass-wordpress-azure-plugin
- **Phying News:** https://phying.com/item/4696