A critical authentication bypass vulnerability in the SAML Single Sign On plugin for WordPress allows unauthenticated attackers to hijack administrative sessions.

The plugin incorrectly validates signature results from the OpenSSL library, where an error state is erroneously treated as a successful verification, allowing unauthenticated attackers to bypass security checks entirely.

This vulnerability allows full account takeover, including administrative access, which can lead to complete site compromise, data theft, and the installation of malicious backdoors. The 9.8 CVSS score reflects the ease of exploitation and the high impact on confidentiality, integrity, and availability.

Immediate Action: Update the SAML Single Sign On – SSO Login plugin to version 5.4.5 or later immediately.

Proactive Monitoring: Review WordPress user login logs for anomalous activity or logins from unrecognized IP addresses, particularly those involving administrative accounts.

Compensating Controls: Disable the plugin if an immediate update cannot be performed and utilize alternative secure authentication methods until the patch is applied.

Public Exploit Available: unknown

This vulnerability represents a significant security risk for any WordPress site utilizing this plugin for SSO. Immediate patching to version 5.4.5 is mandatory to prevent unauthorized administrative access and potential full system compromise.