SAML Single Sign On CVE-2026-19842

The SAML Single Sign On WordPress plugin must be installed, active, and configured for SAML SSO with a live Identity Provider integration - the vulnerable code path is only reachable when the plugin is processing SAML responses. Affected versions are 4.8.85 through below 5.4.7. The most critical limiting condition is the mandatory administrator interaction: an administrator must actively click the one-click certificate promotion control within the WordPress admin UI before the attacker's certificate becomes trusted, confirmed by the UI:R CVSS metric and the explicit description of this control. The initial certificate injection step requires no authentication (PR:N, AV:N), but the complete attack chain is blocked without this privileged UI interaction. Exploitation is therefore constrained by the need to influence a WordPress administrator through social engineering or opportunistic timing during SAML setup or reconfiguration activities. No non-default plugin configuration beyond having SAML SSO active is required.

The CVSS 8.8 score reflects the high combined impact (C:H/I:H/A:H) and the accessible initial attack vector (AV:N/AC:L/PR:N), but the UI:R metric is the critical limiting signal: the certificate injection step is unauthenticated and network-reachable, yet the attack chain cannot complete without an administrator actively clicking the certificate trust promotion control. EPSS at 0.11% in the 1st percentile indicates minimal observed exploitation probability at time of analysis, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread active exploitation. The real-world priority is therefore conditional on whether an attacker can engineer the necessary admin interaction - even a mid-sized municipal IT team in gniezno should treat this as urgent for any WordPress deployment using this plugin for enterprise SSO, since a successful end-to-end attack grants unrestricted administrator impersonation with no further barriers. The absence of a public POC limits opportunistic exploitation in the near term but does not reduce the severity should a targeted attacker pursue social engineering against a site admin. CVSS and EPSS signals are not conflicting here: CVSS reflects worst-case outcome accurately, while EPSS reflects current low exploitation activity.

An attacker crafts a SAML authentication response embedding a self-signed certificate they control and submits it to the target WordPress site's SAML Assertion Consumer Service (ACS) endpoint. The plugin records the attacker's certificate without verifying the SAML response signature. The attacker then social-engineers a site administrator - for example via a phishing message suggesting a SAML reconfiguration is needed - into clicking the one-click certificate promotion control in the WordPress admin panel, at which point the attacker's certificate becomes the site's trusted SAML signing authority, enabling the attacker to forge arbitrary SAML assertions and log in as any user including site administrators. No public POC has been identified at time of analysis.