A critical authentication bypass vulnerability in the SAML Single Sign On WordPress plugin allows unauthenticated attackers to gain full administrative access to affected sites.

This flaw is an instance of Improper Privilege Management (CWE-269) where the plugin fails to honor configured account linking criteria. An unauthenticated attacker can leverage this logic error to authenticate as any user by asserting a specific login name through the identity provider.

The ability for an unauthenticated user to assume an administrative identity poses a catastrophic risk to organizational security. Successful exploitation grants attackers full control over the WordPress installation, enabling data exfiltration, the installation of malicious backdoors, and total site compromise. With a CVSS score of 8.1, this high-severity vulnerability requires immediate attention to prevent unauthorized access and potential data breaches.

Immediate Action: Update the SAML Single Sign On plugin to version 6.0.0 or later immediately to resolve the authentication logic flaw.

Proactive Monitoring: Review WordPress user account activity logs for anomalous login events, specifically focusing on unexpected administrative access or changes to user profiles.

Compensating Controls: If an immediate update is not feasible, consider temporarily disabling the SAML Single Sign On plugin and reverting to standard WordPress authentication methods.

Public Exploit Available: No

Given the severity of this authentication bypass, administrators must prioritize updating the SAML Single Sign On plugin to the patched version. Failure to act leaves the platform vulnerable to complete administrative takeover, which could result in significant operational disruption and loss of data integrity.