Description

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-12T06:16:23.340Z",
  "pubdate": "2026-09-12T06:16:23.340Z",
  "executiveSummary": "The Frontegg SAML SSO WordPress plugin (versions through 1.0.1) contains a critical authentication bypass vulnerability.\nThe flaw stems from the plugin's failure to perform cryptographic validation of SAML authentication responses, specifically neglecting to verify the SAML assertion signature and the identity provider (IdP) issuer.\nThis vulnerability permits an unauthenticated attacker to forge arbitrary SAML assertions and submit them to the service provider, resulting in unauthorized access to the WordPress environment.\nThe impact is severe, as the attacker can impersonate any user, including accounts with administrative privileges, or facilitate the creation of unauthorized accounts.\nThis vulnerability carries the highest risk rating as it allows for full application compromise without requiring valid credentials, bypasses standard authentication workflows, and requires no interaction from the targeted user.\nThe exploitation process does not require access to the SAML IdP’s private keys, making the attack surface publicly accessible to any actor capable of crafting a malformed SAML response to the plugin's assertion consumer service endpoint.",
  "technicalDetails": "The root cause of this vulnerability is an improper implementation of the SAML 2.0 protocol within the Frontegg SAML SSO WordPress plugin. Specifically, the plugin fails to implement mandatory security checks for incoming SAML assertions during the authentication callback process.\nIn a secure SAML exchange, the Service Provider (SP) must validate the digital signature of the XML assertion using the IdP's public key to ensure integrity and authenticity. Furthermore, the SP must verify that the issuer field in the assertion matches the expected IdP to prevent man-in-the-middle or spoofing attacks. The vulnerable plugin neglects both of these validation requirements.\nThe attack flow proceeds as follows: An attacker identifies the plugin's Assertion Consumer Service (ACS) endpoint. The attacker then constructs a malicious SAML Response XML document. Since the plugin does not verify the cryptographic signature of this document, the attacker does not need to possess a valid certificate or private key from the legitimate IdP. Within the XML payload, the attacker populates the 'NameID' field with the identifier of the targeted user, such as an administrator's email or username.\nOnce the forged XML payload is submitted to the plugin's ACS endpoint via an HTTP POST request, the plugin parses the assertion. Because there is no signature validation, the plugin trusts the contents of the forged assertion implicitly. Because there is no issuer verification, the plugin accepts the response regardless of its origin. The plugin then proceeds to identify the user based on the forged 'NameID' and establishes a session for the attacker in the context of that user.\nThis behavior results in a complete authentication bypass. Because the plugin logic executes within the WordPress environment, establishing this session grants the attacker all privileges associated with the spoofed user account. If the target is an administrator, the attacker achieves full administrative control over the WordPress installation, enabling arbitrary code execution through plugin/theme uploads, data exfiltration, or persistence mechanisms such as the creation of additional backdoored administrative accounts.\nThe vulnerability is present in all plugin versions up to and including 1.0.1. It is accessible via the network, requires zero authentication or user interaction, and represents a failure to adhere to secure SAML implementation standards."
}