The vulnerability is an authentication bypass that occurs when the plugin accepts a forged SAML assertion because it uses the signature algorithm specified in the client‑supplied SAMLResponse instead of the algorithm configured by the site administrator. By doing so, an attacker can recast a legitimate RSA public key as an HMAC‑SHA1 shared secret and validate the forged signature, obtaining a valid WordPress authentication cookie. The result is a complete administrator‑level takeover of a WordPress site.

The flaw affects the WordPress plugin "SAML Single Sign On – SSO Login" provided by cyberlord92. All releases up to and including version 5.4.3 are vulnerable. Users running any of these versions should confirm that the plugin is installed and determine the exact version they are hosting.

The CVSS score of 9.8 indicates critical severity, while the EPSS score of <1%% shows a very low but nonzero likelihood of exploitation in the wild. The vulnerability has not been listed in the CISA KEV catalog, but the potential for unauthenticated attackers to obtain administrative privileges makes it a high priority. Attackers can target any site that uses the affected plugin, even with minimal user interaction, by sending a crafted SAMLResponse. The signature algorithm confusion allows the attacker to bypass authentication without possessing valid credentials.