CVE-2026-82842 Overview
CVE-2026-82842 is an authentication bypass vulnerability in the SAML Single Sign On WordPress plugin before version 6.0.0. The plugin fails to honour the configured criterion for linking an incoming single sign-on (SSO) identity to a WordPress account. Instead of matching identities using the administrator-selected attribute, the plugin always resolves the identity by login name. An attacker who can influence the identity provider (IdP) to assert an arbitrary login name can authenticate as any WordPress account, including administrator accounts, without proving ownership.
Critical Impact
Attackers capable of controlling IdP assertions can authenticate as any WordPress user, including administrators, leading to full site compromise.
Affected Products
- SAML Single Sign On WordPress plugin versions before 6.0.0
- WordPress sites relying on the plugin for federated authentication
- Deployments where the IdP allows attacker-influenced login name assertions
Discovery Timeline
- 2026-09-20 - CVE-2026-82842 published to NVD
- 2026-09-21 - Last updated in NVD database
Technical Details for CVE-2026-82842
Vulnerability Analysis
The vulnerability, categorized as [CWE-269] Improper Privilege Management, resides in the identity-linking logic of the SAML Single Sign On plugin. Site administrators can configure which SAML attribute maps an incoming assertion to a local WordPress account. Common criteria include email address, NameID, or a custom attribute. The plugin ignores this configuration and consistently resolves identities using the login name field.
This behavior collapses the trust model of SAML authentication. Any principal capable of causing the IdP to emit an assertion containing a chosen login name is granted access to the matching WordPress account. The impact scales with the privilege of the targeted account, allowing full administrative takeover of the WordPress site.
Root Cause
The root cause is a logic flaw in the plugin's assertion consumer service. The configured attribute-mapping criterion is not read or enforced during account lookup. The code path unconditionally queries WordPress users by user_login, bypassing the security boundary the administrator intended to establish.
Attack Vector
The attack requires the adversary to have the site's IdP issue a SAML assertion asserting a login name of their choosing. This condition is satisfied in multi-tenant IdPs where users can control profile fields, in environments where self-service registration allows arbitrary login name selection, or where the IdP trusts unauthenticated attribute sources. Once the assertion reaches the plugin, the attacker is logged in as the WordPress account matching the asserted login name.
No exploitation code is required beyond a valid SAML assertion. Refer to the WPScan Vulnerability Report for further technical detail.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-82842
Indicators of Compromise
- SAML authentication events where the asserted login name does not match the expected mapping attribute for the same user.
- Successful administrator logins originating from SSO sessions tied to unfamiliar IdP subjects or NameIDs.
- Creation of new administrator accounts or plugin/theme installations shortly after an SSO login event.
Detection Strategies
- Correlate WordPress wp_login audit records with SAML assertion logs to identify mismatches between the asserted identity attribute and the resolved WordPress user.
- Alert on any SSO-driven authentication into privileged WordPress roles, especially outside of expected working hours or geographies.
- Review IdP logs for assertions that set the login name attribute to values matching existing WordPress administrator usernames.
Monitoring Recommendations
- Enable verbose logging in the SAML plugin and forward events to a centralized log platform for correlation.
- Monitor changes to WordPress user roles, capabilities, and the wp_users table for unexpected modifications.
- Track outbound requests and file writes from wp-content following administrative logins to identify post-authentication payload deployment.
How to Mitigate CVE-2026-82842
Immediate Actions Required
- Upgrade the SAML Single Sign On WordPress plugin to version 6.0.0 or later on all affected sites.
- Audit WordPress administrator and editor accounts for unauthorized logins since the plugin was deployed.
- Rotate credentials, API keys, and secrets stored within WordPress if compromise cannot be ruled out.
Patch Information
The vendor addressed the flaw in version 6.0.0 of the SAML Single Sign On plugin by enforcing the administrator-configured identity-linking criterion during assertion processing. See the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Disable the SAML Single Sign On plugin until it can be upgraded to a fixed release.
- Restrict which principals can obtain IdP assertions for the WordPress relying party, and prevent user-controlled values in the login name attribute at the IdP.
- Enforce additional access controls such as IP allowlisting or a reverse proxy requiring separate authentication in front of /wp-admin.
# Configuration example: disable the vulnerable plugin via WP-CLI until patched
wp plugin deactivate miniorange-saml-20-single-sign-on
wp plugin status miniorange-saml-20-single-sign-on
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
