CVE-2026-75807
Received Received - Intake

Authentication Bypass in SAML Single Sign On WordPress Plugin

Publication date: 2026-08-29

Last updated on: 2026-08-29

Assigner: Wordfence

Description
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-29
Last Modified
2026-08-29
Generated
2026-08-29
AI Q&A
2026-08-29
EPSS Evaluated
N/A
NVD
CVE-2026-75807
EUVD
EUVD-2026-68133

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
miniorange saml_single_sign_on to 5.4.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the SAML Single Sign On – SSO Login plugin for WordPress up to version 5.4.6. It allows unauthenticated attackers to bypass authentication by forging SAML assertions. The issue occurs because the plugin stores an attacker-controlled X.509 certificate before validating the SAMLResponse signature, enabling full privileged access to WordPress accounts.

Detection Guidance

Check if the SAML Single Sign On – SSO Login plugin for WordPress is installed and verify its version. If it is version 5.4.6 or lower, the system is vulnerable. Look for unusual SAML authentication logs or errors like test_config_error_wpsamlerr004.

Impact Analysis

An attacker could exploit this to gain administrator-level access to your WordPress site without credentials. This could lead to complete site takeover, data theft, or malicious modifications. The exploit requires an administrator to trigger a specific error during configuration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance. Unauthorized access risks data breaches, which may result in legal penalties, fines, or reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Update the SAML Single Sign On – SSO Login plugin to the latest version immediately. If an update is not available, disable the plugin until a patch is released. Review SAML authentication logs for signs of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75807. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart