CVE-2025-7045 MEDIUM

CVE-2025-7045: Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action

Vendor Cloudinfrastructureservices
Product Cloud SAML SSO – Single Sign On Login
Weakness CWE-306 · Missing auth
Published September 6, 2025
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any configured IdP, breaking the SSO authentication flow and causing a denial-of-service.

Explanation of Vulnerability in Simple Terms

02Summary

Cloud SAML SSO versions up to 1.0.19 contain a missing authentication control that allows unauthenticated attackers to modify data or disrupt service availability over the network. No user interaction is required. The vulnerability affects the integrity and availability of the service but not confidentiality. Update to a version newer than 1.0.19.

What an attacker can do

03Attacker Capabilities

Modify data or disrupt service availability without authentication.

Potential impact on your site

04Site Impact

Unauthorized users can alter configuration or cause service outages without logging in.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

September 6, 2025 CVE published
April 8, 2026 Record updated