EUVD-2026-83667
GHSA-c354-pg28-5955
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and needs no WordPress account (PR:N/UI:N), but requires control over the IdP-asserted login name (AC:H); success grants admin access, so C/I/A all High.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the SAML Single Sign On WordPress plugin (versions 4.8.43 through <6.0.0) lets a remote, unauthenticated attacker log in as any WordPress user, including an administrator. The plugin ignores whatever account-linking criterion the administrator configured (email, NameID, etc.) and always resolves the SAML identity by login name, so an attacker who can get the site's trusted Identity Provider to assert a login name of their choosing - for example via an IdP that allows self-service registration or user-controlled username attributes, or a compromised or attacker-operated IdP - authenticates as that account without proving ownership of it. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the site to use this plugin for SAML SSO on an affected version (4.8.43 through <6.0.0), and requires the attacker to be able to have the site's Identity Provider assert a login name of the attacker's choosing - for example an IdP that permits self-service registration or user-controlled login-name/username attributes, or a compromised or attacker-operated IdP trusted by the site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority authentication flaw, not a high-CVSS-but-low-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the SAML Single Sign On WordPress plugin to 6.0.0 or later, which is the version that closes the flawed login-name-only account resolution; all versions below 6.0.0, including the confirmed affected 4.8.43 through the 5.x line, should be treated as vulnerable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Vendor-released patch: 6.0.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Saml Single Sign On
View allThe resolution SAML SSO apps for Atlassian products allow a remote attacker to login to a user account when only the use
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows at
Missing permission checks in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allow attackers with Overall/Read
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows at
An issue was discovered in the SAML Single Sign On (SSO) plugin for several Atlassian products affecting versions 3.1.0
Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform hostname validation when connecting to miniOr
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 through 2.3.0 (both inclusive) allows attack
A missing permission check in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers with Overall/Re
Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for co
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today