CVE-2026-75807: SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate option before the signature-validation verdict is enforced, because mosamlfindcertificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the testconfigerrorwpsamlerr004 error message during the test configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SAML Single Sign On – SSO Login plugin for WordPressto a version that resolves this vulnerability.Fixed in 5.4.6 - Operational
After receiving the test_config_error_wpsamlerr004 error message during the test configuration, perform the required repair to complete remediation.
Event History
Frequently Asked Questions
What must an attacker do before they can impersonate a WordPress user?
The attacker must submit a SAMLResponse that causes the plugin to store an attacker-controlled X.509 certificate. Exploitation also requires an administrator to perform a repair after seeing the test_config_error_wpsamlerr004 error during test configuration.
How much access could an attacker obtain after successful exploitation?
An attacker could forge SAML assertions for any WordPress account, including administrator accounts. This can result in a fully privileged WordPress session.
Is the test_config_error_wpsamlerr004 message evidence of compromise?
The available information identifies this error as part of the exploitation prerequisite because an administrator must repair the configuration after receiving it. It does not establish that the error alone proves a certificate was poisoned or that an account was compromised.