Signature Verification Flaw in SAML Single Sign On Plugin for WordPress
CVE-2026-19842
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 19 August 2026
Badges
What is CVE-2026-19842?
The SAML Single Sign On WordPress plugin, prior to version 5.4.7, contains a serious security flaw that fails to adequately verify the signature of SAML responses before storing the accompanying certificate. This oversight allows an admin-level user to inadvertently promote an unverified certificate to the trusted signing certificate of the site with a simple one-click action. As a result, an attacker can leverage this vulnerability to create their own trusted certificate, enabling them to authenticate as any user, including site administrators, thereby compromising site integrity and security.
Affected Version(s)
SAML Single Sign On 4.8.85 < 5.4.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.