WordPress Plugin Vulnerabilities

OneLogin SAML SSO < 2.2.0 - Provisioned User Hardcoded Password

Description

The OneLogin SAML SSO WordPress plugin was affected by a Provisioned User Hardcoded Password security vulnerability.

Affects Plugins

Plugin icon
onelogin-saml-sso
Fixed in 2.2.0

References

CVE
CVE-2016-10928
URL
https://github.com/onelogin/wordpress-saml/commit/fbe808e2fd8fde8cb7e6bf365c5334b5702262da

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.5 (high)

Miscellaneous

Submitter
ethicalhack3r
Submitter twitter
ethicalhack3r
Verified
No
WPVDB ID
e22c2450-9bac-4a0a-a6b4-68db717c7b68

Timeline

Publicly Published
2016-06-06 (about 9 years ago)
Added
2016-06-06 (about 9 years ago)
Last Updated
2020-09-22 (about 5 years ago)

Other

Published
Title
Published
2026-03-02
Title
LMS Elementor Pro <= 1.0.4 - Unauthenticated Privilege Escalation
Published
2024-10-09
Title
UserPlus <= 2.0 - Editor+ Registration Form Update to Privilege Escalation
Published
2023-08-21
Title
MasterStudy LMS < 3.0.18 - Unauthenticated Instructor Account Creation
Published
2026-03-12
Title
Xagio SEO – AI Powered SEO < 7.1.0.31 - Unauthenticated Privilege Escalation
Published
2024-04-25
Title
Barcode Scanner with Inventory & Order Manager < 1.5.4 - Unauthenticated Privilege Escalation