What is the CVSS score of CVE-2026-82842?

CVE-2026-82842 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SAML Single Sign On are affected by CVE-2026-82842?

The SAML Single Sign On WordPress plugin (versions 4.8.43 through 6.0.0) contains an authentication bypass that allows remote unauthenticated attackers to impersonate any user, including…. A patch is available.

Is there a public PoC exploit available for CVE-2026-82842?

Yes, a public proof-of-concept exploit is available for CVE-2026-82842. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-82842?

Vendor-released patch: 6.0.0. Within 24 hours, identify all WordPress sites running the SAML Single Sign On plugin versions 4.8.43 through 6.0.0 and apply the patch by upgrading to version 6.0.0 or later; if patching is not immediately possible, disable the plugin or temporarily restrict IdP assertions to mitigate risk. Within 7 days, verify that all instances have been patched, review authentication logs for unauthorized access attempts, and ensure IdP configurations strictly control asserted login-name attributes. Within 30 days, conduct a comprehensive audit of SSO integrations, implement continuous monitoring for authentication anomalies, and establish a regular patch management process for all WordPress plugins.

SAML Single Sign On CVE-2026-82842

EUVD-2026-83667 HIGH

Improper Privilege Management (CWE-269)

2026-09-20 WPScan

GHSA-c354-pg28-5955

WordPress Privilege Escalation Saml Single Sign On

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable and needs no WordPress account (PR:N/UI:N), but requires control over the IdP-asserted login name (AC:H); success grants admin access, so C/I/A all High.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 20, 2026 - 15:23 vuln.today

Analysis Generated

Sep 20, 2026 - 14:24 vuln.today

CVSS changed

Sep 20, 2026 - 14:22 NVD

8.1 (HIGH)

Patch available

Sep 20, 2026 - 07:01 EUVD

CVE Published

Sep 20, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Sep 20, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.

Articles & Coverage 1

News 7 New WordPress Vulnerabilities - All High Severity, 7 With POC Sep 21, 2026

AnalysisAI

Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Requires the site to use this plugin for SAML SSO on an affected version (4.8.43 through <6.0.0), and requires the attacker to be able to have the site's Identity Provider assert a login name of the attacker's choosing - for example an IdP that permits self-service registration or user-controlled login-name/username attributes, or a compromised or attacker-operated IdP trusted by the site. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a genuine high-priority authentication flaw, not a high-CVSS-but-low-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patch: upgrade the SAML Single Sign On WordPress plugin to 6.0.0 or later, which is the version that closes the flawed login-name-only account resolution; all versions below 6.0.0, including the confirmed affected 4.8.43 through the 5.x line, should be treated as vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report.