A flaw in the SAML Single Sign On – SSO Login WordPress plugin allows an attacker without authentication to replace the stored IdP signing certificate with a malicious value, then forge SAML assertions for any account. This enables full administrative control of the WordPress site because the plugin subsequently accepts the forged assertions as valid. The weakness stems from incorrect handling of certificate validation, which is a form of authentication bypass (CWE‑287).

The vulnerability affects the WordPress plugin SAML Single Sign On – SSO Login, versions up to and including 5.4.6. All WordPress installations using these plugin versions are at risk if an administrator has performed a repair after seeing the test_config_error_wpsamlerr004 message, which triggers the faulty certificate persistence behavior.

The CVSS score is 7.5, indicating a high impact. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting there is no confirmed public exploitation yet. However, the flaw can be exploited remotely by an attacker who can manipulate SAML responses and cause the plugin to store an attacker‑controlled certificate, leading to unrestricted access. The attack requires the victim’s administrator to perform a repair action after receiving the specific error message, but once the malicious certificate is stored, the attacker can send forged SAML assertions at any time.