CVE-2026-75800: Frontegg SAML SSO Authentication Bypass

CVE-2026-75800 Overview

CVE-2026-75800 is an authentication bypass vulnerability in the Frontegg SAML SSO WordPress plugin through version 1.0.1. The plugin fails to verify the signature or issuer of Security Assertion Markup Language (SAML) authentication responses before establishing a user session. Unauthenticated attackers can forge SAML responses to log in as any existing user, including administrators. The flaw also permits creation of arbitrary WordPress accounts. The weakness is classified as Improper Authentication [CWE-287].

Critical Impact
Remote, unauthenticated attackers can gain administrative access to affected WordPress sites by submitting crafted SAML responses.

Affected Products

Frontegg SAML SSO WordPress plugin versions up to and including 1.0.1
WordPress installations with the Frontegg SAML SSO plugin enabled
Any tenant relying on the plugin for single sign-on authentication

Discovery Timeline

2026-09-12 - CVE-2026-75800 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-75800

Vulnerability Analysis

The Frontegg SAML SSO plugin processes SAML authentication responses without validating cryptographic integrity or asserting the identity of the issuing Identity Provider (IdP). SAML relies on XML digital signatures to prove that assertions originate from a trusted IdP and have not been tampered with. When a Service Provider (SP) skips signature verification, any attacker capable of reaching the SAML Assertion Consumer Service (ACS) endpoint can submit a self-crafted response.

The plugin trusts the NameID and attribute values in the assertion and maps them to a WordPress user account. If a matching account exists, a session is established for that user. If no account exists, the plugin provisions one using attacker-controlled values, enabling account takeover and privilege escalation to the administrator role.

Root Cause

The root cause is missing validation of two mandatory SAML security controls: the XML Signature over the Response or Assertion element, and the Issuer element identifying the trusted IdP. Without these checks, the plugin cannot distinguish legitimate assertions from forgeries.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP POST request to the plugin's SAML ACS endpoint. The request contains a SAML response naming the target user, such as an administrator, in the NameID field. The plugin parses the assertion, skips signature and issuer validation, and issues an authenticated session cookie. The attacker then accesses the WordPress admin dashboard with full privileges.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-75800

Indicators of Compromise

Unexpected administrator or editor accounts created without a corresponding provisioning workflow
WordPress wp_users entries with email domains or usernames that do not match the configured IdP tenant
Successful SAML logins in web server access logs that lack a preceding AuthnRequest from the site
POST requests to the plugin's SAML ACS endpoint from IP addresses outside the trusted IdP range

Detection Strategies

Inspect SAML responses submitted to the plugin's ACS endpoint and verify that each contains a valid ds:Signature element and expected Issuer value
Correlate WordPress authentication events with IdP-side authentication logs; flag sessions that lack a matching IdP-issued assertion
Alert on new WordPress account creation events tied to the Frontegg plugin outside change windows

Monitoring Recommendations

Forward WordPress authentication and user-creation events to a central logging pipeline for correlation with IdP telemetry
Enable web application firewall (WAF) logging for the SAML ACS URL and review for anomalous request bodies
Monitor for privilege changes on existing accounts, particularly promotions to the administrator role

How to Mitigate CVE-2026-75800

Immediate Actions Required

Disable or uninstall the Frontegg SAML SSO plugin until a fixed version is confirmed available
Rotate credentials and invalidate active sessions for all WordPress users, prioritizing administrators
Audit wp_users and wp_usermeta for accounts created since the plugin was installed and remove unauthorized entries
Restrict access to /wp-admin and the SAML ACS endpoint by source IP where feasible

Patch Information

No patched version is identified in the referenced advisory at the time of publication. Monitor the WPScan Vulnerability Report and the plugin vendor's channels for a release above version 1.0.1 that enforces SAML signature and issuer verification.

Workarounds

Deactivate the Frontegg SAML SSO plugin and require users to authenticate via native WordPress credentials protected by multi-factor authentication
Deploy a WAF rule that blocks POST requests to the plugin's SAML ACS endpoint from untrusted source networks
Enforce IP allowlisting so only the configured Frontegg IdP infrastructure can reach the ACS URL
Substitute an alternative SAML SSO plugin that enforces signature and issuer validation on inbound assertions

bash

# Example: temporarily disable the plugin from the WordPress CLI
wp plugin deactivate frontegg-saml-sso
wp plugin delete frontegg-saml-sso

# Audit recently created accounts
wp user list --orderby=registered --order=DESC --fields=ID,user_login,user_email,roles,user_registered