SAML Single Sign On Plugin Flaw Enables WordPress Account Takeover

Executive Summary

A high-severity authentication bypass (CVE-2026-82842, CVSS 8.1) has been disclosed in the SAML Single Sign On plugin by miniOrange for WordPress. Versions before 6.0.0 fail to honour the site's configured criterion for linking an incoming SAML identity to a WordPress account — instead, the plugin always resolves the identity by login name, no matter what matching rule the administrator has set.

An attacker who controls (or can influence) the assertions returned by the site's identity provider can assert a login name matching any existing account, including an administrator, and authenticate as that user without proving ownership of it.

Vulnerability Overview

Root Cause

Sites using SAML SSO typically let administrators choose how an incoming identity from the IdP is mapped to a local WordPress account — for example, by email address, a unique SAML NameID, or login name. The vulnerable versions of this plugin ignore that configured criterion entirely: regardless of what the admin selects, the plugin resolves the mapping by login name only. An attacker who can shape the identity provider's assertion (through a compromised or rogue IdP, a misconfigured trust relationship, or a federation the attacker partially controls) can set the asserted login name to match a target account and be logged in as that user.

Affected Versions

This is distinct from the earlier CVE-2026-19842 in the same plugin family, which was a separate authentication bypass patched in 5.4.7. The miniOrange SAML plugin has logged upward of two dozen disclosed vulnerabilities through 2026, including prior issues involving certificate poisoning and trust-anchor overwrites — sites should confirm they are current on all patches, not just this one.

Attack Vector

1. Attacker gains the ability to shape or forge SAML assertions reaching the site
   (rogue/compromised IdP, federation misconfiguration, or MITM on the assertion path)
2. Attacker sets the asserted login name to match a target WordPress account
3. Plugin resolves the identity by login name, ignoring the site's configured
   matching criterion (e.g. email or unique NameID)
4. Attacker is authenticated as the target account without proving ownership

Impact of Successful Exploitation

Immediate Remediation

Step 1: Update to Version 6.0.0

wp plugin update miniorange-saml-20-single-sign-on
wp plugin get miniorange-saml-20-single-sign-on --field=version

Step 2: Review IdP Trust Configuration

• Confirm the identity provider(s) trusted by the plugin are exactly the ones you expect
• Rotate SAML signing certificates if there is any suspicion of IdP compromise
• Prefer matching criteria based on immutable, verified identifiers over login name where the plugin allows it, once patched

Step 3: Audit for Suspicious Logins

# Review recent admin logins for anomalies
wp user list --role=administrator --fields=user_login,user_email
 
# Check server/application logs around the SSO callback endpoint for unexpected assertions
grep -i "saml" /path/to/wordpress/wp-content/debug.log

If Immediate Patching Is Not Possible

1. Temporarily disable SSO login and fall back to standard WordPress authentication
2. Restrict which IdPs are trusted at the plugin configuration level
3. Force a password reset and re-enable MFA for all administrator accounts as a precaution

References

• NVD — CVE-2026-82842
• WPScan — SAML Single Sign On Plugin Vulnerabilities
• OffSeq Threat Radar — CVE-2026-82842

Related Reading

• CVE-2026-0953: Critical Auth Bypass in Tutor LMS Pro
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+