{"id":"CVE-2026-82842","title":"The SAML Single Sign On  WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has cho…","summary":"The SAML Single Sign On  WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has cho…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-269"],"product":"SAML Single Sign On","affected":["saml_single_sign_on >= 4.8.43 < 6.0.0"],"published":"2026-09-20","updated":"2026-09-21","sourceUpdated":"2026-09-21T13:34:57.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82842","references":[{"url":"https://wpscan.com/vulnerability/4ae66b2c-a0de-405f-baca-127302257540/","label":"contact@wpscan.com"}],"tags":["nvd","cve.org"],"epss":0.0022,"epssPercentile":0.12798,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-09-20T13:48:57.522788Z"},"ingestedAt":"2026-09-20T07:16:12.222Z","slug":"CVE-2026-82842","body":"## Overview\n\nThe SAML Single Sign On  WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":44.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":208013,"id":"CVE-2026-82842","ts":1789914180493,"field":"cvss","old":null,"new":"8.1"},{"seq":208012,"id":"CVE-2026-82842","ts":1789914180493,"field":"severity","old":"none","new":"high"}]}