SAML Single Sign On EUVD-2026-83667

Requires the site to use this plugin for SAML SSO on an affected version (4.8.43 through <6.0.0), and requires the attacker to be able to have the site's Identity Provider assert a login name of the attacker's choosing - for example an IdP that permits self-service registration or user-controlled login-name/username attributes, or a compromised or attacker-operated IdP trusted by the site. The flaw is that the plugin ignores whatever account-linking criterion the admin configured (email, NameID, etc.) and always matches on login name, so no ownership of the target account is proven. Limiting factors: exploitation is unauthenticated at the WordPress layer (PR:N) but is gated by the attacker's degree of control over the trusted IdP's assertions (reflected in CVSS AC:H); sites whose IdP strictly controls the asserted login-name attribute are much harder to exploit.

This is a genuine high-priority authentication flaw, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H = 8.1) correctly captures a network-reachable, unauthenticated (PR:N) account takeover with full C/I/A impact - successful exploitation yields administrator access to the WordPress site. The mitigating signal is AC:H, which reflects a real prerequisite: the attacker must be able to make the site's SAML Identity Provider assert an arbitrary login name. A publicly available exploit exists (WPScan) and a vendor patch (v6.0.0) is available, which raises real-world urgency. However, no EPSS score and no CISA KEV listing are present in the provided data, so there is no evidence of confirmed active exploitation or of automated widespread targeting - the difficulty is that exploitation is deployment-specific (it hinges on how much control an attacker has over the IdP assertion), so this is better treated as a targeted rather than mass-exploitation risk. Net: patch promptly given POC availability and admin-level impact, but the AC:H IdP-control precondition limits opportunistic exploitation.

On a WordPress site using this plugin for SAML SSO where the linking criterion was configured to match on email or NameID, an attacker who controls or can influence assertions from the site's IdP (e.g., a self-service IdP allowing users to set their own login-name attribute, or a compromised/malicious IdP) crafts an assertion carrying the login name of the target administrator. The plugin ignores the configured criterion and resolves purely by login name, logging the attacker in as that administrator without proving ownership. A public exploit is available via WPScan, and the flaw is remotely reachable without a prior WordPress account (PR:N).