CVE-2026-19842: SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite
The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.
Affected Software
Event History
Frequently Asked Questions
Which plugin versions are affected?
Versions before 5.4.7 are affected. Upgrade the WordPress SAML Single Sign On plugin to 5.4.7 or later.
What access does an attacker need to start the attack?
An attacker can submit a SAML response without authentication. The response signature is not verified before its included certificate is stored.
Is administrator interaction required for full account takeover?
Yes. An administrator must use the plugin's one-click control to promote the attacker-controlled stored certificate to the site's trusted signing certificate. After that, the attacker can authenticate as any user, including an administrator.
What is the immediate mitigation if the plugin cannot be updated?
Do not use the one-click control to promote a stored certificate to the trusted signing certificate, particularly for certificates received in SAML responses. This prevents the described trust-anchor overwrite step.