Frontegg SAML SSO EUVD-2026-76816

Requires only that the target WordPress site has the Frontegg SAML SSO plugin (version ≤1.0.1) installed and active with its SAML login/assertion consumer endpoint reachable by the attacker. No authentication, no user interaction, and no non-default configuration beyond having SSO enabled are needed. The primary limiting factor is deployment footprint: the site must actually run this specific plugin, and the SAML endpoint must be network-reachable to the attacker.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is consistent with the description: a remote, unauthenticated attacker needs no user interaction and only has to submit a forged SAML Response to the plugin's assertion consumer endpoint. Successful exploitation yields administrator access, so the C:H/I:H/A:H impacts are justified - an admin can read all data, alter content, and take the site offline. The main tempering signal is EPSS (0.19%, 8th percentile) and the absence of KEV or known POC, which together suggest no observed mass exploitation yet; however, low EPSS on a trivially-exploitable, well-documented WordPress auth bypass most likely reflects the plugin's small install base rather than exploitation difficulty, so it should not lower urgency for anyone actually running it. Any operator with this plugin - from large enterprises down to small municipal or mid-sized IT teams - should treat exposure as urgent given the low skill barrier and full-takeover outcome.

An attacker crafts a SAML Response asserting the username of a site administrator (or a new account), then posts it to the plugin's assertion consumer endpoint over the internet without any credentials or user interaction. Because the plugin never checks the signature or issuer, it creates an authenticated admin session, granting full control of the WordPress site. No public POC is currently identified, but the attack is straightforward given standard SAML tooling.