Frontegg SAML SSO Plugin Flaw Lets Anyone Log In as WordPress Admin

Executive Summary

A critical authentication bypass (CVE-2026-75800) has been disclosed in the Frontegg SAML SSO plugin for WordPress. The plugin fails to verify the cryptographic signature or issuer of incoming SAML authentication responses before establishing a session, allowing unauthenticated attackers to forge assertions and log in as any user, including administrators, or create arbitrary new accounts outright.

CVSS Score: 9.8 (Critical)

Because signature and issuer validation are the two checks that make SAML trustworthy, skipping both effectively turns the plugin's single sign-on flow into an open door — no credentials, phishing, or password guessing required.

Vulnerability Overview

Affected Versions

Attack Vector

1. Attacker identifies a WordPress site running Frontegg SAML SSO
2. Attacker crafts a SAML authentication response naming an arbitrary
   user (e.g. an administrator) as the assertion subject
3. Plugin accepts the response without verifying its signature or issuer
4. WordPress establishes a session for the forged identity
5. Attacker gains full administrative access, or creates a new
   administrator account outright

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 1.0.2

# Via WP-CLI
wp plugin update frontegg-saml-sso
 
# Verify the installed version
wp plugin get frontegg-saml-sso --field=version

Or update through WordPress admin: Plugins > Installed Plugins > Frontegg SAML SSO > Update Now.

Step 2: Audit for Unauthorized Access

# Look for administrator accounts created outside your normal onboarding process
wp user list --role=administrator --fields=ID,user_login,user_registered
 
# Review authentication logs around the SAML ACS endpoint for anomalies
grep -i "saml" /var/log/apache2/access.log | tail -200

If Immediate Patching Is Not Possible

1. Disable SAML authentication and fall back to native WordPress login
2. Block the SAML assertion consumer endpoint at the web server or WAF level until patched
3. Force a password reset for all administrator accounts as a precaution
4. Deploy WAF rules that flag malformed or unsigned SAML XML in POST requests

Post-Remediation Steps

1. Confirm plugin updated to 1.0.2 or later
2. Audit all administrator and privileged accounts for ones you don't recognize
3. Rotate WordPress security keys and salts (wp config shuffle-salts)
4. Review SAML identity provider configuration to ensure signing is enforced on the IdP side too
5. Enable file integrity monitoring to catch any changes made during the exposure window

References

• OffSeq Threat Radar — CVE-2026-75800 CWE-287 Improper Authentication in Frontegg SAML SSO
• VulDB — CVE-2026-75800 in SAML SSO Plugin
• NIST NVD — CVE-2026-75800

Related Reading

• Critical RCE in WPvivid Backup Plugin Threatens 900,000+
• Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+