The Cloud SAML SSO WordPress plugin contains a missing capability check on the delete_config action. An unauthenticated attacker can send a request that triggers this action and deletes any configured Identity Provider. The loss of an IdP breaks the SSO authentication flow, causing a denial‑of‑service for users who depend on single sign‑on.

WordPress installations running the Cloud SAML SSO – Single Sign On Login plugin, with versions up to and including 1.0.19, are affected. Any site that has Identity Providers configured is at risk.

The vulnerability carries a CVSS score of 6.5 and an EPSS score of less than 1 %, indicating moderate impact and a low likelihood of exploitation at present. The plugin is not listed in the CISA KEV catalog. Attackers could exploit the flaw remotely without authentication by targeting the delete_config endpoint, which would immediately remove IdP settings and incapacitate the SSO feature. Because the issue is a missing authorization check (CWE‑306), remediation via a patch or disabling the vulnerable action will eliminate the risk.