The SAML Single Sign On – SSO Login plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticated attackers to hijack administrative accounts.

The vulnerability exists in the mo_saml_login_validate() function, which improperly persists untrusted X.509 certificates from incoming SAML responses. An unauthenticated attacker can overwrite the configured identity provider certificate and forge assertions to gain full administrative access.

A successful exploitation of this vulnerability results in a complete compromise of the WordPress environment, as attackers can impersonate any user, including high-privilege administrators. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk of data exfiltration, unauthorized system configuration changes, and total loss of site integrity.

Immediate Action: Monitor the vendor for the release of a security patch and update the plugin immediately upon availability. If an update is not yet available, consider disabling the plugin until a secure version is deployed.

Proactive Monitoring: Review WordPress administrative user logs for unexpected login events or unauthorized account creations. Monitor plugin settings for modifications to the identity provider certificate configuration.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to inspect and filter suspicious SAML response traffic. Ensure that administrative access to the WordPress dashboard is restricted to trusted IP addresses where possible.

Public Exploit Available: Unknown

This vulnerability represents a critical risk to the security of the WordPress platform. Administrators should prioritize identifying instances of this plugin in their environment and maintain high vigilance for vendor updates. Immediate remediation is required to prevent potential unauthorized access and complete site takeover.