CVE-2026-82842 in SAML Single Sign On Plugin
Summary
by MITRE • 09/20/2026
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/20/2026
The vulnerability identified in versions of the SAML Single Sign On WordPress plugin prior to 6.0.0 represents a critical authentication bypass flaw rooted in improper identity mapping logic. The core technical deficiency lies in how the plugin processes incoming assertions from an external Identity Provider during the SAML authentication flow. Specifically, the software fails to respect the administrator-configured criterion for linking or matching an incoming single sign-on identity to an existing WordPress user account. Instead of adhering to settings that might prioritize email addresses, unique identifiers, or other specific attributes for user resolution, the plugin unconditionally resolves the incoming identity based solely on the login name attribute provided in the SAML assertion. This rigid behavior creates a predictable and exploitable path for attackers who have control over the content of assertions issued by their own Identity Provider.
From an operational security perspective, this flaw allows for account takeover attacks against any user within the WordPress installation, including those with administrative privileges. An attacker can configure their external identity provider to assert a login name that matches an existing target account on the vulnerable site. When the victim attempts to log in via SAML or when the system processes the assertion, the plugin will map this incoming identity directly to the targeted local account without verifying ownership of that specific identifier through secondary means such as email verification or manual pre-provisioning checks. Consequently, if an attacker can control the login name attribute sent by their Identity Provider, they can authenticate as any user on the platform simply by matching the username string, effectively bypassing traditional password-based authentication controls for SAML-enabled users.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding the failure to correctly verify identity before granting access. It also relates closely to CWE-613, Insufficient Session Expiration, in contexts where session hijacking might be facilitated by persistent unauthorized access gained through this method. Furthermore, within the MITRE ATT&CK framework, this behavior facilitates Initial Access techniques such as Valid Accounts and potentially Credential Stuffing if combined with other reconnaissance methods, although the primary vector here is Identity Spoofing via SAML assertion manipulation. The severity of this issue is heightened by its potential to grant full administrative control over a WordPress site, which often serves as the entry point for broader network compromise or data exfiltration depending on the site's role and integrations.
Mitigation strategies must focus on immediate remediation through software updates and configuration hardening. The primary solution is to upgrade the SAML Single Sign On plugin to version 6.0.0 or later, where this mapping logic has been corrected to honor configured identity linking criteria. For environments unable to update immediately due to compatibility constraints, administrators should implement compensating controls such as restricting which users are allowed to authenticate via SAML by limiting access to specific user roles that do not possess critical privileges until the patch is applied. Additionally, enforcing strict validation of incoming SAML assertions and ensuring that identity providers only assert login names for accounts explicitly pre-registered or verified can reduce risk. Regular auditing of authentication logs for anomalous login patterns associated with unexpected Identity Provider sources may also aid in early detection of exploitation attempts.