CVE-2026-82842: CWE-269 Improper Privilege Management in SAML Single Sign On
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
AI Analysis
Technical Summary
CVE-2026-82842 describes an improper privilege management vulnerability (CWE-269) in the SAML Single Sign On WordPress plugin versions from 4.8.43 up to but not including 6.0.0. The plugin fails to honor the configured linking criteria for incoming single sign-on identities and instead resolves identities solely by login name. An attacker capable of influencing the identity provider to assert an arbitrary login name can authenticate as any WordPress user, including administrators, without needing to prove account ownership.
Potential Impact
An attacker who can manipulate the site's identity provider can bypass intended authentication controls and gain unauthorized access to any WordPress account, including those with administrative privileges. This could lead to full site compromise or unauthorized administrative actions.
Mitigation Recommendations
Upgrade the SAML Single Sign On WordPress plugin to version 6.0.0 or later, where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version range indicating the fix in 6.0.0.
CVE-2026-82842: CWE-269 Improper Privilege Management in SAML Single Sign On
Description
The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.
CVSS v3.1
Score 8.1high
Affected software
SAML Single Sign On
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-82842 describes an improper privilege management vulnerability (CWE-269) in the SAML Single Sign On WordPress plugin versions from 4.8.43 up to but not including 6.0.0. The plugin fails to honor the configured linking criteria for incoming single sign-on identities and instead resolves identities solely by login name. An attacker capable of influencing the identity provider to assert an arbitrary login name can authenticate as any WordPress user, including administrators, without needing to prove account ownership.
Potential Impact
An attacker who can manipulate the site's identity provider can bypass intended authentication controls and gain unauthorized access to any WordPress account, including those with administrative privileges. This could lead to full site compromise or unauthorized administrative actions.
Mitigation Recommendations
Upgrade the SAML Single Sign On WordPress plugin to version 6.0.0 or later, where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the version range indicating the fix in 6.0.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-31T08:27:11.846Z
- State
- PUBLISHED
Threat ID: 6aaf7de855bf5e2cf5adcf98
Added to database: 09/20/2026, 06:32:08 UTC
Last enriched: 09/20/2026, 06:47:23 UTC
Last updated: 09/20/2026, 17:29:59 UTC
Views: 38
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.