CVE-2020-26511

CVE-2020-26511 describes an authentication bypass vulnerability in the wpo365-login plugin for WordPress, affecting versions prior to 11.7. This flaw stems from the plugin's use of a symmetric algorithm to decrypt JWT tokens, allowing an attacker to forge valid tokens. Rated with a CVSS score of 7.5 (High), this vulnerability is easily exploitable over the network with low attack complexity, potentially leading to high integrity impact without requiring user interaction. While the EPSS score is low, indicating a low probability of exploitation, the FAUCET Risk Score is moderate at 51/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage, suggesting a lack of widespread attention or exploitation attempts.