What is CVE-2026-15212?
The WPO365 | Login plugin for WordPress, up to version 43.2, is vulnerable to Cross-Site Request Forgery (CSRF). This stems from the Ajax_Service::verify_ajax_request() function's reliance on the 'enable_nonce_check' boolean, which is absent from the default settings. Updating to the latest plugin version is advised.
Azərbaycanca: WordPress üçün WPO365 | Login plaginində, versiya 43.2 və daha əvvəlki versiyalarda Cross-Site Request Forgery (CSRF) zəifliyi aşkar edilib. Bu zəiflik Ajax_Service::verify_ajax_request() funksiyasında wp_verify_nonce() çağırışının default olaraq aktiv olmayan 'enable_nonce_check' parametri arxasında yoxlanılması səbəbindən baş verir. Plaginin ən son versiyasına yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-352
FAQ2
Which versions of the WPO365 | Login plugin are vulnerable to the CSRF flaw?
The WPO365 | Login plugin for WordPress up to version 43.2 is affected by this vulnerability.
What is the root cause of this CSRF vulnerability?
The vulnerability occurs because the Ajax_Service::verify_ajax_request() function relies on the 'enable_nonce_check' boolean for the wp_verify_nonce() call, which is absent from the default settings.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.