CVE-2026-82842 — SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always re…
Published: 2026-09-20 · CVSS: 8.1 · CVSS 3.1
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7