CVE-2026-75807 cyberlord92 CVE debrief

Who should care

WordPress administrators and users of the SAML Single Sign On – SSO Login plugin, especially those with administrative privileges, should be aware of this vulnerability. They should verify their installed plugin version, review configuration, and apply updates if necessary to prevent potential authentication bypass attacks. Security teams should monitor for suspicious SAML login attempts and review system logs for potential exploitation attempts.

Technical summary

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced. The plugin's improper handling of certificate validation allows attackers to manipulate the stored IdP signing certificate.

Defensive priority

WordPress SAML Single Sign On – SSO Login plugin users should prioritize verification of their installed version and apply updates if necessary.

Recommended defensive actions

• Verify the installed version of the WordPress SAML Single Sign On – SSO Login plugin and apply updates if necessary.
• Restrict access to the plugin's configuration pages.
• Monitor for suspicious SAML login attempts.
• Review system logs for potential exploitation attempts.
• Consider implementing compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass due to improper validation of X.509 certificates in SAML responses. This allows unauthenticated attackers to overwrite the stored IdP signing certificate and forge SAML assertions for any WordPress account. Evidence is limited to public sources and vendor statements. Defenders should verify their installed plugin version, review configuration, and monitor for suspicious login attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.