CVE-2022-4496

Name of the Vulnerable Software and Affected Versions SAML SSO Standard WordPress plugin versions 16.0.0 through 16.0.7 SAML SSO Premium WordPress plugin versions 12.0.0 through 12.0.x before 12.1.0 SAML SSO Premium Multisite WordPress plugin versions 20.0.0 through 20.0.6

Description The issue arises from the failure to validate that the redirect parameter to the SSO login endpoint points to an internal site URL, leading to an Open Redirect issue when the user is already logged in.

Recommendations For SAML SSO Standard WordPress plugin versions 16.0.0 through 16.0.7, update to version 16.0.8 or later. For SAML SSO Premium WordPress plugin versions 12.0.0 through 12.0.x before 12.1.0, update to version 12.1.0 or later. For SAML SSO Premium Multisite WordPress plugin versions 20.0.0 through 20.0.6, update to version 20.0.7 or later.