CVE-2026-75807

The SAML Single Sign On – SSO Login plugin for WordPress (developed by miniOrange) in versions up to and including 5.4.6 contains an authentication bypass (CWE-287): the mo_saml_login_validate() ACS handler saves the X.509 certificate taken from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch instead of halting execution. An unauthenticated attacker can send a crafted SAMLResponse that overwrites the plugin's stored IdP signing certificate with an attacker-controlled value; per the advisory, full exploitation additionally requires an administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during test configuration. With the attacker's certificate in place, the attacker can forge SAML assertions for any WordPress account, including administrators, and obtain a fully privileged session. Any WordPress site running the plugin at version 5.4.6 or earlier is affected. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS assigns a 0.3% probability of exploitation in the next 30 days.

What to do: Update the SAML Single Sign On – SSO Login plugin to a patched release newer than 5.4.6 as soon as one is available (the data does not specify the exact fixed version). Until patched, avoid the plugin's test-configuration and repair flows, and if you encounter the test_config_error_wpsamlerr004 error, update the plugin before using the repair option. Also verify that the stored IdP signing certificate (the mo_saml_required_certificate option) still matches your identity provider and review logs for unexpected SAML-based logins to privileged accounts.