{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awordpresssaml_single_sign_on_sso_login/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wordpress:saml_single_sign_on_sso_login:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-75807"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SAML Single Sign On – SSO Login (\u003c= 5.4.6)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-75807","authentication-bypass","wordpress"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe SAML Single Sign On - SSO Login plugin for WordPress (versions 5.4.6 and earlier) contains a critical authentication bypass vulnerability (CVE-2026-75807). The flaw resides in the mo_saml_login_validate() Assertion Consumer Service (ACS) handler. When processing an incoming SAMLResponse, the plugin extracts an X.509 certificate and persists it into the mo_saml_required_certificate configuration option before the digital signature verification is fully enforced. The underlying mo_saml_find_certificate() function returns false when a fingerprint mismatch occurs, but it fails to halt the execution of the handler. This allows an unauthenticated remote attacker to submit a crafted SAMLResponse containing a malicious certificate. The plugin erroneously accepts and saves the attacker's certificate as the trusted IdP signing certificate. With this configuration overwritten, the attacker can subsequently forge arbitrary SAML assertions for any WordPress user account, including those with administrative privileges, leading to full site takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker monitors for target WordPress sites using the vulnerable SAML Single Sign On - SSO Login plugin.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious SAMLResponse containing an attacker-controlled X.509 certificate.\u003c/li\u003e\n\u003cli\u003eAttacker submits the crafted SAMLResponse to the ACS URL of the vulnerable WordPress plugin.\u003c/li\u003e\n\u003cli\u003eThe mo_saml_login_validate() handler processes the incoming request and extracts the attacker's malicious certificate.\u003c/li\u003e\n\u003cli\u003eThe plugin saves the malicious certificate into the mo_saml_required_certificate database option due to insufficient validation logic.\u003c/li\u003e\n\u003cli\u003eThe site administrator receives a test_config_error_wpsamlerr004 error message during routine configuration testing, signaling a state change.\u003c/li\u003e\n\u003cli\u003eAttacker uses the now-trusted malicious certificate to sign and submit a forged SAML assertion for an administrative user.\u003c/li\u003e\n\u003cli\u003eWordPress accepts the forged assertion as valid, granting the attacker a fully privileged administrative session.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in full administrative takeover of the WordPress instance. An attacker can gain unauthorized access to any account, modify site content, exfiltrate sensitive data, or install malicious plugins to establish persistence. This vulnerability affects any organization utilizing the SAML Single Sign On - SSO Login plugin for identity management.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize patching the SAML Single Sign On - SSO Login plugin for WordPress. Immediately upgrade to a version later than 5.4.6, as per official vendor releases. Detection teams should review web server logs for irregular POST requests directed at the SAML ACS endpoint containing unexpected certificate content or suspicious identity assertion patterns.\u003c/p\u003e\n\u003ch2 id=\"rules\"\u003eRules\u003c/h2\u003e\n\u003cp\u003etitle: \u0026quot;Detect CVE-2026-75807 Exploitation - Malicious SAMLResponse Submission\u0026quot;\ndescription: \u0026quot;Detects exploitation attempts against the SAML Single Sign On - SSO Login plugin by monitoring for POST requests to the ACS handler that trigger configuration errors.\u0026quot;\nlogsource:\ncategory: \u0026quot;webserver\u0026quot;\ndetection:\nselection:\ncs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem|contains: \u0026quot;/saml-sso-login\u0026quot;\nfilter:\nsc-status: \u0026quot;200\u0026quot;\ncondition: selection and not filter\nlevel: \u0026quot;high\u0026quot;\ntags:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u0026quot;attack.initial_access\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;attack.t1550.001\u0026quot;\nfalsepositives:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Legitimate configuration errors or failed SSO logins by users with misconfigured IdP certificates\u0026quot;\ntests:\npositive:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Malicious SAMLResponse trigger\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem: \u0026quot;/saml-sso-login/acs\u0026quot;\nsc-status: \u0026quot;500\u0026quot;\nnegative:\u003c/li\u003e\n\u003cli\u003ename: \u0026quot;Successful legitimate SSO login\u0026quot;\ndata:\u003c/li\u003e\n\u003cli\u003ecs-method: \u0026quot;POST\u0026quot;\ncs-uri-stem: \u0026quot;/saml-sso-login/acs\u0026quot;\nsc-status: \u0026quot;302\u0026quot;\nhandoff:\ndetection_confidence: \u0026quot;medium\u0026quot;\nrequired_telemetry:\u003c/li\u003e\n\u003cli\u003elog_source: \u0026quot;webserver\u0026quot;\nevent_or_channel: \u0026quot;HTTP request logs\u0026quot;\nrequired_fields:\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-method\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;cs-uri-stem\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u0026quot;sc-status\u0026quot;\navailability: \u0026quot;available\u0026quot;\nnotes: \u0026quot;Requires standard web server access logs capturing request URI and status codes.\u0026quot;\nvalidation:\nstatus: \u0026quot;needs_environment_validation\u0026quot;\nsteps:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Review logs for frequent 500-level errors on the SAML plugin ACS path.\u0026quot;\nexpected_telemetry: \u0026quot;HTTP 500 responses associated with the plugin ACS URI.\u0026quot;\npass_criteria: \u0026quot;Detection of spikes in failed authentication attempts during plugin configuration.\u0026quot;\nknown_evasions:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Attacker might use randomized endpoints or proxying to hide the origin.\u0026quot;\nlimitations:\u003c/li\u003e\n\u003cli\u003e\u0026quot;Detection relies on the presence of error codes, which may be suppressed or logged differently.\u0026quot;\ntuning:\u003c/li\u003e\n\u003cli\u003esource: \u0026quot;Normal SSO activity\u0026quot;\nguidance: \u0026quot;Baseline the volume of failed SSO attempts to distinguish exploitation from user error.\u0026quot;\nportability_notes:\u003c/li\u003e\n\u003cli\u003eplatform: \u0026quot;Splunk\u0026quot;\nnote: \u0026quot;Use standard web access log fields (cs-uri-stem, sc-status).\u0026quot;\nsuggested_owner: \u0026quot;Detection Engineering\u0026quot;\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-29T19:41:11Z","date_published":"2026-08-29T19:41:11Z","id":"https://feed.craftedsignal.io/briefs/2026-08-saml-sso-bypass/","summary":"An unauthenticated authentication bypass vulnerability in the SAML Single Sign On - SSO Login plugin allows attackers to overwrite the IdP signing certificate and forge administrative sessions.","title":"Authentication Bypass in SAML Single Sign On - SSO Login Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-08-saml-sso-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wordpress:saml_single_sign_on_sso_login:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}