{"id":"CVE-2026-19842","aliases":["EUVD-2026-62293","GHSA-qj54-25r3-fmh2"],"status":"published","title":"SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite","description":"The SAML Single Sign On  WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00291,"percentile":0.21815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-08-19T06:00:21Z","modified":"2026-11-09T20:10:00Z","products":[{"vendor":"unknown","product":"saml single sign on"}],"references":[{"url":"https://wpscan.com/vulnerability/7b79d86e-d3f8-4d4f-929b-fd00540cc00f/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19842"},{"url":"https://wpscan.com/vulnerability/7b79d86e-d3f8-4d4f-929b-fd00540cc00f"},{"url":"https://github.com/advisories/GHSA-qj54-25r3-fmh2"}],"sources":{"cve":[{"id":"CVE-2026-19842","title":"SAML Single Sign On 4.8.85 - 5.4.6 - Unauthenticated Administrator Account Takeover via SAML Trust Anchor Overwrite","description":"The SAML Single Sign On  WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.","status":"published","published":"2026-08-19T06:00:21.841Z","modified":"2026-08-19T16:41:23.609Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-62293","description":"The SAML Single Sign On  WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.","status":"published","published":"2026-08-19T06:00:21Z","modified":"2026-08-19T16:41:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:41.405951Z"}],"ghsa":[{"id":"GHSA-qj54-25r3-fmh2","title":"The SAML Single Sign On  WordPress plugin before 5.4.7 does not verify the signature of a SAML...","description":"The SAML Single Sign On  WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.","status":"published","published":"2026-08-19T06:31:18Z","modified":"2026-08-19T18:33:51Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:10:44.12734Z"}],"nvd":[{"id":"CVE-2026-19842","description":"The SAML Single Sign On  WordPress plugin before 5.4.7 does not verify the signature of a SAML response before storing the certificate it carries, and offers an administrator a one-click control that promotes that stored certificate to the site's trusted signing certificate, allowing unauthenticated attackers to have a certificate of their own trusted and then authenticate as any user, including an administrator.","status":"published","published":"2026-08-19T06:17:40.613Z","modified":"2026-11-09T20:10:00.2Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-09T22:15:51.558963Z"}]}}