Is my WordPress plugin safe?

• Sep 20, 2026SAML Single Sign On: Does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress accountCVE-2026-82842 · fixed in 6.0.0 · reported by WPScanHigh 8.1

  The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.

  NVD recordwpscan.com

• Aug 29, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-75807 · affects up to 5.4.6 · reported by WordfenceHigh 7.5

  The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Aug 19, 2026SAML Single Sign On: Does not verify the signature of a SAML response before storing the certificate it carriesCVE-2026-19842 · fixed in 5.4.7 · reported by WPScanHigh 8.8

  The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.

  NVD recordwpscan.com

• Aug 13, 2026Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.CVE-2026-61979 · affects up to 5.4.3 · reported by PatchstackHigh 8.1

  Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

  NVD recordpatchstack.com

• Jul 23, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-15981 · affects up to 5.4.4 · reported by WordfenceCritical 9.8

  The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jul 16, 2026SAML Single Sign On – SSO Login: Authentication BypassCVE-2026-15013 · affects up to 5.4.3 · reported by WordfenceCritical 9.8

  The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.

  NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Dec 13, 2024SAML SP Single Sign On: Missing AuthorizationCVE-2023-41873 · affects up to 5.0.4 · reported by PatchstackMedium 4.3

  Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.

  NVD recordpatchstack.com

• Feb 17, 2020Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php.CVE-2020-6850 · fixed in 4.8.84 · reported by MITREMedium 6.1

  Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.

  NVD recordwordpress.orgzeroauth.ltd

Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.