Tanishq Shah

**Name of the Vulnerable Software and Affected Versions** SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.7 **Description** An authentication bypass exists due to the `mo saml login validate()` ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the `mo saml required certificate` option before the signature-validation verdict is enforced. This occurs because `mo saml find certificate()` returns false on a fingerprint mismatch instead of halting execution. Unauthenticated attackers can overwrite the stored IdP signing certificate with a controlled value and forge SAML assertions for any account, including administrators, to gain a privileged session. This exploit requires the administrator to perform a repair after receiving the `test config error wpsamlerr004` error message during test configuration. **Recommendations** Update the SAML Single Sign On – SSO Login plugin for WordPress to version 5.4.7 or later.