SAML Single Sign On Vulnerability in WordPress Plugin by WordPress
CVE-2026-82842

Currently unrated

Key Information:

Vendor

WordPress
Status
Saml Single Sign On
Vendor
CVE Published:
20 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-82842?

The SAML Single Sign On WordPress plugin prior to version 6.0.0 fails to respect the configured criteria for linking incoming single sign-on identities to WordPress accounts. Instead, it always resolves the identity using the login name specified by the site. This flaw allows an attacker, capable of influencing the site's identity provider, to assert any login name they choose. As a result, they could authenticate as any WordPress account, potentially gaining access to administrative privileges without needing to prove ownership of the account.

Affected Version(s)

SAML Single Sign On 4.8.43 < 6.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-82842 - Proof of Concept

References

https://wpscan.com/vulnerability/4ae66b2c-a0de-405f-baca-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Karthik Ramakrishnan
WPScan
.