HomeWordPress vulnerabilitiesSAML Single Sign On
SAML Single Sign On vulnerabilities
SAML Single Sign On has 6 known vulnerabilities in this database. The most recent published record is dated 20 Sep 2026.
- Known vulnerabilities
- 6
- Active installs
- 10,000+
- Latest version
- 6.0.0
- Last updated
- 17 Sep 2026
- Most recent
- 20 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Privilege escalation CVE-2026-82842 | High 8.1 | Before 6.0.0 | Fixed in 6.0.0 | 20 Sep 2026 |
| Authentication bypass CVE-2026-75807 | High 7.5 | Up to 5.4.6 | Fixed in a later version (latest 6.0.0) | 29 Aug 2026 |
| Authentication bypass CVE-2026-19842 | High 8.8 | Before 5.4.7 | Fixed in 5.4.7 | 19 Aug 2026 |
| Authentication bypass CVE-2026-15981 | Critical 9.8 | Up to 5.4.4 | Fixed in a later version (latest 6.0.0) | 23 Jul 2026 |
| Authentication bypass CVE-2026-15013 | Critical 9.8 | Up to 5.4.3 | Fixed in a later version (latest 6.0.0) | 16 Jul 2026 |
| Cross-site scripting (XSS) CVE-2020-6850 | Medium 6.1 | Before 4.8.84 | Fixed in 4.8.84 | 17 Feb 2020 |
Read the published descriptions
- CVE-2026-82842, 20 Sep 2026
- The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account. CVE record
- CVE-2026-75807, 29 Aug 2026
- The SAML Single Sign On - SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account - including administrators - to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration. CVE record
- CVE-2026-19842, 19 Aug 2026
- The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator. CVE record
- CVE-2026-15981, 23 Jul 2026
- The SAML Single Sign On - SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error - bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account. CVE record
- CVE-2026-15013, 16 Jul 2026
- The SAML Single Sign On - SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account - including administrators - obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover. CVE record
- CVE-2020-6850, 17 Feb 2020
- Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element. CVE record
What to do if you run SAML Single Sign On
If you run SAML Single Sign On, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new SAML Single Sign On vulnerabilities
Free. We email you when a new vulnerability is published for SAML Single Sign On, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.