CVE-2026-82842

Summary

This flaw allows an attacker to authenticate as any account, including an administrator, by controlling the login name asserted by the identity provider, bypassing the configured criterion for linking identities.

Exploitability

Exploitation is relatively straightforward if the attacker can control the identity provider's assertion, as no additional authentication is required beyond the login name.

Blast radius

The impact is high, as it allows unauthorized access to any account, including administrative privileges, potentially leading to complete compromise of the WordPress site.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 6.0.0 or later of the SAML Single Sign On WordPress plugin.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.