SAML SSO Plugin Authentication Bypass via Certificate Validation

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mo_saml_login_validate() ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before the signature-validation verdict is enforced, because mo_saml_find_certificate() returns false on a fingerprint mismatch rather than halting execution. This makes it possible for unauthenticated attackers to overwrite the plugin's stored IdP signing certificate with an attacker-controlled value, and subsequently forge SAML assertions for any WordPress account — including administrators — to obtain a fully privileged session. Note: The exploit requires the administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error message during the test configuration.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The SAML Single Sign-On Login plugin for WordPress contains a critical authentication bypass vulnerability affecting versions up to 5.4.6. The flaw exists in the mo_saml_login_validate() handler, which persists X.509 certificates extracted from SAML responses into WordPress options before signature validation is completed. Because the mo_saml_find_certificate() function returns false on fingerprint mismatches rather than halting execution, an unauthenticated attacker can craft malicious SAML responses with self-signed or attacker-controlled certificates to bypass authentication checks entirely. This directly impacts any WordPress installation using this plugin for enterprise SSO, potentially allowing unauthorized access to sensitive administrative functions and user accounts without valid credentials.

Casky's 283 mapped security skills identify this vulnerability through Claude AI's analysis of authentication and credential access patterns (MITRE TA0004 and TA0006). Practitioners using Casky would detect suspicious findings across multiple attack vectors: failed signature validation attempts followed by successful authentication, SAML responses with certificate fingerprints mismatched to configured values, and authentication flows where certificate persistence occurs prior to cryptographic verification. The platform's extended reasoning capabilities would flag the logical flaw in the validation sequence—where a false return value doesn't prevent execution continuation—revealing how an attacker chains valid SAML assertion structure with invalid cryptographic proof. Security teams would see anomalous patterns in SAML handler logs showing accepted authentications despite failed certificate checks, enabling rapid identification of exploitation attempts before compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-75807.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-75807

Casky has 283 skills that investigate the attack patterns behind CVE-2026-75807. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn