Technical impact
The Cloud SAML SSO plugin for WordPress contains a missing capability check for the set_organization_settings action. The handler accepts client‑supplied POST parameters for organization settings and passes them directly to update_option() without validating the user’s capabilities or including a CSRF nonce. This weakness allows an unauthenticated attacker to change critical SSO configuration, such as signing and encryption toggles, which can break the authentication flow and cause a denial‑of‑service. The flaw is a classic example of Missing Authorization (CWE‑862).
Affected Systems
WordPress sites that have installed Cloud Infrastructure Services’ Cloud SAML SSO – Single Sign On Login plugin, version 1.0.19 or earlier. All earlier releases share the same code path that performs the insecure update. The issue is not present in versions newer than 1.0.19, provided the vendor has addressed the capability check in the fix.
Risk and Exploitability
The vulnerability scores a 8.2 on the CVSS scale, indicating a high‑severity condition. The EPSS score is less than 1 %, suggesting that exploitation is infrequent but possible. The vulnerability is not listed in the CISA KEV catalog. Because the action is reachable via an unauthenticated POST request that lacks a CSRF token, an attacker can trigger it solely by sending a crafted HTTP request to the plugin’s endpoint. Successful exploitation results in unauthorized configuration changes that can compromise the integrity of the SSO flow and render user authentication ineffective, leading to a denial‑of‑service for legitimate users.
