CVE-2026-75807

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.7

Description An authentication bypass exists due to the mo saml login validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo saml required certificate option before the signature-validation verdict is enforced. This occurs because mo saml find certificate() returns false on a fingerprint mismatch instead of halting execution. Unauthenticated attackers can overwrite the stored IdP signing certificate with a controlled value and forge SAML assertions for any account, including administrators, to gain a privileged session. This exploit requires the administrator to perform a repair after receiving the test config error wpsamlerr004 error message during test configuration.

Recommendations Update the SAML Single Sign On – SSO Login plugin for WordPress to version 5.4.7 or later.