Description

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-20T07:16:50.093Z",
  "pubdate": "2026-09-20T07:16:50.093Z",
  "executiveSummary": "The SAML Single Sign On WordPress plugin before version 6.0.0 contains a critical authentication bypass vulnerability stemming from flawed identity matching logic.\nThe plugin fails to honor the administrator-defined criteria for account mapping, defaulting exclusively to the 'login name' attribute regardless of the site configuration.\nThis flaw allows an attacker capable of manipulating assertions via the Identity Provider (IdP) to impersonate any user, including high-privileged administrator accounts, without providing valid credentials or proof of account ownership.\nThe impact is a full authentication bypass, leading to unauthorized account takeover and potential complete site compromise.\nSuccessful exploitation requires the attacker to influence the IdP response to provide a username associated with a target account within the WordPress environment.\nThis vulnerability highlights a critical failure in the verification process between the SAML assertion and the local WordPress user database.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the SAML identity resolution logic within the SAML Single Sign On WordPress plugin. The plugin is designed to allow administrators to configure specific criteria for linking an incoming SAML assertion to a local WordPress user, such as email address or a specific SAML attribute.\nHowever, in versions prior to 6.0.0, the plugin logic ignores these configured settings entirely. Instead, the application hardcodes the identity resolution process to rely solely on the SAML 'login name' field extracted from the assertion. This behavior deviates from the expected security contract, where the plugin should respect the binding configuration specified in the administrative dashboard.\nThe exploitation flow begins when an attacker performs a SAML-based authentication flow redirected to the vulnerable WordPress site. The attacker must possess the ability to control or influence the identity assertion issued by the configured IdP. When the IdP sends the SAML response to the WordPress site, the plugin parses the assertion to identify the user.\nBecause the plugin forces the use of the 'login name' as the unique identifier for mapping, an attacker can craft or provide an assertion that contains the username (e.g., 'admin') of a legitimate WordPress account. Upon receipt of this assertion, the plugin performs a lookup in the wp_users table using the provided login name. Because the plugin does not enforce the proper secondary validation or respect the user-defined binding method (like email validation), it resolves the incoming identity to the victim's account.\nConsequently, the plugin automatically logs the attacker into the application as the resolved user without requiring further proof of identity, such as a matching email address or a secret token. If the attacker targets the 'admin' account, they are immediately granted full administrative privileges. This bypass effectively renders the SAML configuration insecure, as it bypasses the standard verification checks required to prove that the user attempting to log in is indeed the legitimate owner of the local WordPress account. The vulnerability is present in all versions prior to 6.0.0 and requires no specific privilege level from the attacker, provided they can trigger a valid SAML response from the IdP containing a target's login name."
}