SAML SSO Login CVE-2026-75807

Exploitation requires the SAML Single Sign On - SSO Login plugin (≤5.4.6) to be installed, active, and configured with a live SAML Identity Provider - sites with the plugin installed but SAML unconfigured are not vulnerable. The critical gate is mandatory user interaction: a WordPress administrator must encounter the test_config_error_wpsamlerr004 error during the plugin's test configuration flow and then perform the repair action, during which the ACS endpoint must receive the attacker's crafted SAMLResponse. Without this specific administrator-triggered repair event, the certificate-overwrite path is unreachable. Factors limiting exploitation include: the attacker must be able to deliver a crafted HTTP request to the ACS endpoint coinciding precisely with the administrator's repair action (a timing and access dependency); the administrator must be actively using the test configuration UI at the moment of attack; and no default WordPress configuration automatically triggers this flow. The PR:N CVSS metric confirms no authentication is required to send the SAMLResponse to the ACS endpoint itself, but the UI:R and AC:H metrics confirm that unaided mass scanning against all WordPress sites is not viable.

The NVD-assigned CVSS 3.1 score of 7.5 (High) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a realistic balance: the C/I/A:H impacts are warranted because successful exploitation yields full WordPress administrator compromise, but AC:H and UI:R substantially reduce opportunistic mass-exploitation risk. The AC:H metric captures the need for the attacker to time the SAMLResponse delivery to a specific window when the administrator is actively in the repair flow following a test_config_error_wpsamlerr004 error, which requires either social engineering or monitoring of the target site's administrative activity. UI:R reflects that the administrator must take a deliberate repair action. No EPSS data was provided in the source intelligence, preventing quantitative exploitation probability comparison. No CISA KEV listing is present, and no POC has been identified - exploitation remains theoretical at time of analysis. The real-world priority is elevated for any WordPress site that uses SAML-based SSO for administrative access, particularly in enterprise and education environments, since a successful attack results in a persistent, fully privileged session with no prior foothold required at the network level. Sites without SAML SSO active (plugin installed but unconfigured) are not exposed.

An attacker identifies a WordPress site running the miniOrange SAML SSO plugin in an active SAML configuration. The attacker either socially engineers the administrator into running a SAML test (or waits for routine administrative activity), causing the test_config_error_wpsamlerr004 error to appear and prompting the admin to click the repair action. During this repair window, the attacker submits a crafted SAMLResponse containing their own X.509 certificate to the ACS endpoint; the plugin persists this certificate as the trusted IdP certificate without validating the signature. The attacker then signs a forged SAML assertion claiming to be a WordPress administrator and authenticates, obtaining a fully privileged session.