CVE-2025-7045: Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action
The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the deleteconfig action of the cssohandleactions() function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any configured IdP, breaking the SSO authentication flow and causing a denial-of-service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7045?
CVE-2025-7045 is considered a high severity vulnerability due to its potential for unauthenticated access to sensitive features.
How do I fix CVE-2025-7045?
To fix CVE-2025-7045, update the Cloud SAML SSO plugin to the latest version released after 1.0.19.
Who is affected by CVE-2025-7045?
Any WordPress site using the Cloud SAML SSO plugin version 1.0.19 or earlier is affected by CVE-2025-7045.
What type of vulnerability is CVE-2025-7045?
CVE-2025-7045 is an Identity Provider Deletion vulnerability impacting the Cloud SAML SSO plugin for WordPress.
Can CVE-2025-7045 be exploited remotely?
Yes, CVE-2025-7045 can be exploited remotely by unauthenticated attackers due to the lack of capability checks.