WordPress Plugin Vulnerabilities

Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse

Description

The plugin does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.

Proof of Concept

Affects Plugins

Plugin icon
frontegg-saml-sso
No known fix

References

CVE
CVE-2026-75800

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
moonge
Submitter
moonge
Verified
Yes
WPVDB ID
be658aa5-8f7f-4938-bf13-b2e6ed3dcf89

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2024-10-25
Title
User Toolkit < 1.2.4 - Authenticated (Subscriber+) Authentication Bypass
Published
2026-08-19
Title
User Registration PRO < 5.4.6 - Unauthenticated Privilege Escalation via Account Takeover
Published
2016-07-03
Title
Advanced Ajax Page Loader < 2.7.7 - Unauthenticated Uploaded File Disclosure
Published
2022-11-04
Title
Jeg Elementor Kit < 2.5.7 - Subscriber+ Authorization Bypass
Published
2021-07-19
Title
Profile Builder < 3.4.9 - Admin Access via Password Reset