The vulnerability arises because the WordPress SAML Single Sign On plugin fails to verify the signature of incoming SAML responses before storing the certificate it contains. When an administrator later promotes that stored certificate to the trusted signing certificate through a one‑click option, the attacker injects a self‑signed certificate into the trusted pool. This allows the attacker to authenticate as any user, including administrators, without any credentials. The flaw is classified as an authentication bypass (CWE‑287) with a CVSS score of 8.8, indicating high severity.

The issue affects installations of the WordPress "SAML Single Sign On" plugin at any version up to and including 5.4.6. Versions 5.4.7 and later contain the fix. The plugin is used in WordPress sites that rely on SAML for authentication and expose an administrator control to promote certificates.

The exploit requires no prior access and works via an unauthenticated SAML response, so the attack surface is public. The EPSS score of <1% suggests that, while the potential impact is high, the likelihood of real‑world exploitation is currently low. The vulnerability is not listed in CISA KEV, meaning no confirmed public exploits are documented. Attacker impact includes impersonation of administrators and any other authenticated users, leading to full control over the site.