Frontegg SAML SSO WordPress Plugin Authentication Bypass

The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-75800 represents a critical authentication bypass in the Frontegg SAML SSO WordPress plugin affecting versions through 1.0.1. The vulnerability stems from the plugin's failure to validate SAML response signatures or issuer identity before granting session access. This allows unauthenticated attackers to forge SAML assertions and assume any identity, including administrator accounts, or create entirely new accounts without legitimate authorization. WordPress installations using this plugin—particularly those managing sensitive content or user data—face immediate risk of unauthorized administrative access, data exfiltration, and complete account takeover attacks. The critical CVSS 9.8 score reflects the ease of exploitation and the severe impact on system confidentiality, integrity, and availability.

Casky's 283 matched skills enable detection of the adversarial techniques underlying this attack. Practitioners would observe reconnaissance and exploitation patterns aligned with TA0004 (Initial Access) and TA0006 (Defense Evasion). Claude AI's extended reasoning identifies the CWE-287 (Improper Authentication) pattern by detecting unsigned or unvalidated authentication tokens during login flows, anomalous session creation without credential validation, and suspicious SAML metadata inconsistencies. In practice, security teams using Casky would see findings flagging: (1) authentication attempts with missing XML signature validation, (2) session establishment bypassing issuer verification checks, and (3) account creation events without credential verification. These skill matches provide practitioners with precise, ATT&CK-mapped insights into how adversaries exploit this vulnerability and where defensive controls should focus.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75800.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-75800

Casky has 283 skills that investigate the attack patterns behind CVE-2026-75800. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn