Quick answers
- Is CVE-2026-104759 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-104759 being exploited in the wild.
- How severe is CVE-2026-104759?
- High severity, with a CVSS score of 8.1, published 10 October 2026.
- Which products and versions are affected?
- WPO365 | Login up to and including 44.1.
- Is there a fix for CVE-2026-104759?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-104759 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-104759?
- Check whether you run WPO365 | Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in Id_Token_Service_Deprecated::process_openidconnect_token(), which uses WordPress's wp_verify_nonce() function to validate a 64-character hex nonce created by Nonce_Service::create_nonce(). Since wp_verify_nonce() cannot verify this nonce format, the check silently fails without terminating authentication. An unauthenticated attacker with a previously-issued valid id_token can replay it to authenticate as any user. The flaw only affects installations with the use_id_token_parser_v2 plugin option enabled.
Affected products
- WPO365 WPO365 Login up to and including 44.1
Timeline
- 2026-10-10: disclosed