Home / Vulnerability Intelligence / CVE-2026-2628

CVE-2026-2628 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 3, 2026

All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login - Authentication Bypass

Published: March 3, 2026Updated: March 3, 2026Remote Exploitable

Overview

All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login WordPress plugin <= 2.2.5 contains an authentication bypass caused by improper authentication checks, letting unauthenticated attackers log in as other users including administrators, exploit requires no special privileges.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Unauthenticated attackers can log in as any user, including administrators, leading to full system compromise.

Mitigation

Update to the latest version beyond 2.2.5.

References

Social Media Activity(2 posts)

Offensive Sequence

@offseq

Mar 3, 2026

⚠️ CVE-2026-2628: CRITICAL auth bypass in All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login plugin (≤2.2.5). Attackers can access WP admin accounts with no credentials. Disable plugin or restrict logins until patched! https://radar.offseq.com/threat/cve-2026-2628-cwe-288-authentication-bypass-using--3ce6682b #OffSeq #WordPress #AzureAD

View original post

Offensive Sequence

@offseq

Mar 3, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-2628
Severity: Critical
CVSS Score: 9.8
Type: broken_authentication
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-288

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

0.0%Probability of exploitation in the next 30 days