At WPO365, your security is prioritized. If you haven’t updated the WPO365 | MICROSOFT GRAPH MAILER plugin to the latest version 3.3, please do so immediately. Versions up to and including 3.2 are vulnerable to an Open Redirect issue due to inadequate validation of the ‘redirect_to’ parameter. This flaw could enable a remote attacker to conduct phishing attacks and potentially steal sensitive information under specific conditions:

1. Remote attackers can successfully trick website users into performing an action (e.g. click on a link).
2. The plugin is activated but not configured.

See the following thread-information published by Wordfence.