https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 04:29:07 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-340622 EUVD-2026-340622 https://cve.radiocsirt.org/vuln/euvd-2026-340622 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15212 <p>The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option &#39;enable_nonce_check&#39;, which is absent from the default &#39;wpo365_options&#39; array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied &#39;settings&#39; payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to &#39;administrator&#39; — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.</p> <p>The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option &#39;enable_nonce_check&#39;, which is absent from the default &#39;wpo365_options&#39; array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied &#39;settings&#39; payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to &#39;administrator&#39; — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-15212 https://cve.radiocsirt.org/vuln/ghsa-4w3q-g484-rj57 <p>The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option &#39;enable_nonce_check&#39;, which is absent from the default &#39;wpo365_options&#39; array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied &#39;settings&#39; payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to &#39;administrator&#39; — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.</p> <p>The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option &#39;enable_nonce_check&#39;, which is absent from the default &#39;wpo365_options&#39; array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied &#39;settings&#39; payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to &#39;administrator&#39; — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.</p> https://cve.radiocsirt.org/vuln/ghsa-4w3q-g484-rj57