CVE-2026-19842
SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The SAML Single Sign On WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.
| Vendor | unknown |
| Product | saml single sign on |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown saml single sign on
Be the first to know when new unknown vulnerabilities affecting unknown saml single sign on are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / SAML Single Sign On
4.8.85 < 5.4.7
References
Credits
Suhayb Ahmed WPScan