https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:36:15 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-82842 <p>The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site&#39;s identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.</p> <p>The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site&#39;s identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-82842 https://vulnerability.circl.lu/vuln/ghsa-c354-pg28-5955 <p>The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site&#39;s identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.</p> <p>The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site&#39;s identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account.</p> https://vulnerability.circl.lu/vuln/ghsa-c354-pg28-5955