What the vulnerability does
01Description
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.
Explanation of Vulnerability in Simple Terms
02Summary
The SAML Single Sign On plugin for WordPress contains an authentication bypass vulnerability affecting versions up to 5.4.6. An attacker can bypass SAML authentication checks by manipulating the authentication flow, potentially gaining unauthorized access to user accounts. The vulnerability requires user interaction and network access but does not require prior authentication. Site administrators should update to a version newer than 5.4.6 immediately.
What an attacker can do
03Attacker Capabilities
Bypass SAML authentication and gain unauthorized access to user accounts without valid credentials.
Potential impact on your site
04Site Impact
Unauthorized users can log in as legitimate site users, potentially accessing sensitive data and site functionality.
Conditions required to exploit
05Prerequisites
The victim must visit a malicious link or page crafted by the attacker; no prior authentication required.
Key dates
06Disclosure timeline
August 29, 2026
CVE published
