# CVE-2026-75807: miniOrange SAML Single Sign On authentication bypass

Source: https://junglewise.ai/threats/cve-2026-75807-miniorange-saml-single-sign-on-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75807 · Severity: high · CVSS 7.5 · Published 2026-08-29

The SAML Single Sign On – SSO Login plugin for WordPress allows unauthenticated attackers to bypass authentication and hijack any account, including administrator accounts. An attacker can forge login credentials by overwriting the plugin's stored IdP signing certificate with a malicious one, then forge SAML assertions to gain full administrative access to the WordPress site. This requires an administrator to perform a repair action after a test configuration error, but once exploited, it compromises all account security.

Technologies: [miniOrange SAML Single Sign On – SSO Login](https://junglewise.ai/threats/technologies/saml-single-sign-on-sso-login). Vendors: [miniOrange](https://junglewise.ai/threats/vendors/miniorange).

## Quick answers

**Is CVE-2026-75807 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75807 being exploited in the wild.

**How severe is CVE-2026-75807?** High severity, with a CVSS score of 7.5, published 29 August 2026.

**Which products and versions are affected?** miniOrange SAML Single Sign On – SSO Login up to and including 5.4.6.

**Is there a fix for CVE-2026-75807?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-75807 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-75807?** Check whether you run miniOrange SAML Single Sign On – SSO Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the mo_saml_login_validate() ACS handler. The root cause is that the plugin persists an X.509 certificate from incoming SAMLResponse into the mo_saml_required_certificate option before signature validation is enforced. The mo_saml_find_certificate() function returns false on fingerprint mismatch instead of halting execution, allowing certificate replacement. An unauthenticated attacker can send a malicious SAML response with an attacker-controlled certificate, which overwrites the legitimate IdP certificate. Subsequently, the attacker can forge SAML assertions signed with their certificate to impersonate any WordPress account. Exploitation requires the administrator to encounter and repair the test_config_error_wpsamlerr004 error during test configuration. No patch information is currently available for versions up to 5.4.6.

## Affected products

- miniOrange SAML Single Sign On – SSO Login up to and including 5.4.6

## Timeline

- 2026-08-29: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/class-mo-saml-login-validate.php](https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/class-mo-saml-login-validate.php)
- [https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/class-mo-saml-login-validate.php](https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.6/class-mo-saml-login-validate.php)

## Related threats

- [miniOrange SAML Single Sign On authentication bypass in SSO Login plugin](https://junglewise.ai/threats/cve-2026-15981-miniorange-saml-single-sign-on-authentication-bypass-in-sso-login)
- [miniOrange SAML Single Sign On authentication bypass via algorithm confusion](https://junglewise.ai/threats/cve-2026-15013-miniorange-saml-single-sign-on-authentication-bypass-via)