SAML SSO Plugin Ignores Account Linking Configuration

The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability affects WordPress sites using the SAML Single Sign On plugin versions before 6.0.0. The plugin fails to respect administrator-configured rules for linking SSO identities to WordPress accounts, instead always matching incoming identities by login name alone. An attacker who can influence assertions from the site's identity provider can specify any login name—including administrator accounts—and gain unauthorized access without proving account ownership. This is particularly dangerous because it bypasses the intended security controls that organizations configure to govern identity federation, potentially affecting thousands of WordPress installations that rely on enterprise SSO for authentication.

Casky's platform maps this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation) and surfaces 224 relevant security skills for detection and response. Practitioners using Casky would identify attack patterns including: anomalous SSO assertion attributes that don't match configured linking criteria, successful authentication events where the asserted identity bypasses validation rules, and privilege escalation indicators when non-admin SSO identities suddenly assume administrative roles. Claude's extended reasoning capability helps practitioners correlate SAML assertion logs with WordPress account creation and privilege changes, detect identity provider compromise attempts, and validate whether their plugin versions enforce proper identity linking validation—enabling faster remediation before attackers exploit misconfigurations at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82842.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-82842

Casky has 224 skills that investigate the attack patterns behind CVE-2026-82842. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn