The SAML Single Sign On – SSO Login plugin for WordPress contains a flaw in its signature verification logic. The mo_saml_validate_signature() function performs a loose boolean test on the return value of PHP’s openssl_verify(), treating the error code –1 as a successful verification. An attacker can exploit this by submitting a SAMLResponse that includes a crafted NameID and a deliberately malformed signature. The signature error will be interpreted as valid, and the plugin will call wp_set_auth_cookie() for the targeted account, allowing login as any existing user, including administrators. This flaw enables unauthenticated attackers to gain full account control, leading to confidentiality and integrity compromise across the WordPress site.

All WordPress installations that use the cyberlord92 SAML Single Sign On – SSO Login plugin, version 5.4.4 or earlier, are affected. The vulnerability is present in the plugin’s core validation routines and therefore affects any deployment that enables SAML authentication through this plugin.

The CVSS score of 9.8 indicates the vulnerability is critical, with full credential compromise possible. The EPSS score of less than 1% suggests that exploitation is not currently widespread, but the low probability does not mitigate the severe impact. The vulnerability is not listed in the CISA KEV catalog. It presents a realistic attack path: an unauthenticated attacker can initiate a SAML flow and supply a forged SAMLResponse. The attack would only require the ability to send an HTTP request to the site’s SAML endpoint; no additional user interaction is required.