CVE-2026-75807: CWE-287 Improper Authentication in cyberlord92 SAML Single Sign On – SSO Login

CVE-2026-75807 is an authentication bypass vulnerability in the cyberlord92 SAML Single Sign On – SSO Login WordPress plugin. The vulnerability arises because the mo_saml_login_validate() ACS handler persists the X.509 certificate extracted from an incoming SAMLResponse into the mo_saml_required_certificate option before signature validation is enforced. The function mo_saml_find_certificate() returns false on a fingerprint mismatch but does not halt execution, allowing an attacker to overwrite the stored IdP signing certificate with an attacker-controlled certificate. This enables forging of SAML assertions for any WordPress account, including administrators, resulting in full privileged session takeover. Exploitation requires an administrator to perform a repair after receiving the test_config_error_wpsamlerr004 error during test configuration.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain full administrative access to the affected WordPress site by forging SAML assertions. This compromises confidentiality, integrity, and availability of the site and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been published at this time. Until a patch is available, administrators should avoid performing the repair step after receiving the test_config_error_wpsamlerr004 error during test configuration, as this is required for exploitation. Monitor vendor channels for updates and apply official patches once released.