Description

The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T06:17:40.613Z",
  "pubdate": "2026-08-19T06:17:40.613Z",
  "executiveSummary": "The SAML Single Sign On WordPress plugin prior to version 5.4.7 suffers from a critical authentication bypass vulnerability stemming from improper cryptographic validation. The flaw resides in the handling of incoming SAML responses, where the plugin fails to cryptographically verify the digital signature of the response before extracting and storing the embedded X.509 certificate.\nThis architectural oversight introduces severe risk implications for affected WordPress deployments, allowing unauthenticated remote attackers to achieve arbitrary privilege escalation and full administrative compromise. By exploiting this mechanism, an attacker can supply a crafted SAML response containing a self-signed or attacker-controlled certificate, which is subsequently cached by the application.\nThe vulnerability is critically exacerbated by an administrative one-click control feature within the plugin dashboard. This interface allows an administrator to inadvertently promote the stored, unverified certificate to the site's trusted signing certificate store based on user-supplied input.\nOnce the malicious certificate is promoted, the trust relationship of the single sign-on implementation is entirely subverted. This grants unauthenticated threat actors the capability to forge valid authentication assertions, bypass standard identity verification checks, and authenticate successfully as any registered user within the system, including privileged administrative accounts, without requiring prior credentials or interaction.",
  "technicalDetails": "The root cause of the vulnerability lies in the missing cryptographic validation logic during the ingestion phase of SAML protocol handling within the SAML Single Sign On WordPress plugin. Specifically, when processing an incoming SAML response, the application extracts the X.509 certificate embedded within the payload and writes it to storage without first validating the digital signature of the XML assertion against an existing trusted root or pre-configured anchor.\nThe vulnerable component is the SAML response parsing and certificate management module of the plugin, specifically affecting all versions prior to 5.4.7. The attack surface is exposed over the network via standard HTTP/HTTPS endpoints that handle SAML assertions and Single Sign-On (SSO) redirects.\nExploitation of this vulnerability requires no authentication and no prior privileges, making it accessible to remote unauthenticated attackers over the network. The attack flow proceeds in a structured sequence: First, an unauthenticated attacker crafts a malicious SAML response containing a manipulated X.509 certificate controlled exclusively by the adversary. Second, the attacker transmits this crafted response to the vulnerable WordPress site utilizing the SAML Single Sign On plugin. Third, the plugin parses the payload and stores the unverified certificate without performing cryptographic signature verification to ensure the integrity and authenticity of the message source.\nFourth, the attacker leverages the administrative interface of the plugin, either through social engineering, secondary vulnerabilities, or by exploiting the asynchronous administrative workflow if exposed, wherein the plugin presents a one-click control mechanism to promote the newly stored certificate. Alternatively, if an administrator interacts with the management console and utilizes the one-click feature to trust the newly introduced certificate, the malicious certificate is marked as the site's trusted signing certificate.\nPost-exploitation impact is catastrophic. Once the attacker's certificate is elevated to a trusted status, the SAML validation engine accepts subsequent cryptographic assertions signed by the attacker's private key as authentic. This allows the attacker to forge arbitrary SAML assertions for any user principal mapped within the application, resulting in complete authentication bypass, unauthorized session establishment, and immediate administrative privilege escalation across the target WordPress instance."
}