Frontegg SAML SSO WordPress Plugin Vulnerability Allows Admin Takeover
A critical vulnerability in the Frontegg SAML SSO plugin for WordPress allows unauthenticated attackers to achieve full site takeover.
Frontegg SAML SSO WordPress Plugin Vulnerability Allows Admin Takeover
A critical vulnerability in the Frontegg SAML SSO plugin for WordPress allows unauthenticated attackers to achieve full site takeover.
Critical Flaw in Frontegg SAML SSO plugin
A critical security flaw identified as CVE-2026-75800 has been discovered in the Frontegg SAML SSO plugin for WordPress, according to reports from forkast.news. Carrying a maximum CVSS score of 9.8, the vulnerability allows unauthenticated attackers to completely bypass authentication mechanisms on affected websites. By exploiting this weakness, malicious actors can execute a full administrative takeover of any vulnerable WordPress site.
The issue impacts all versions of the Frontegg SAML SSO plugin up to and including version 1.0.1. The underlying root cause stems from a complete failure to implement standard SAML security checks. Specifically, the software fails to verify the digital signatures of incoming SAML authentication responses and neglects to validate the issuer identifier.
Exploitation Risks and Lack of Patches
Because the plugin accepts assertions without confirming their origin or integrity, attackers can easily forge a SAML assertion to impersonate any existing user, including site administrators. Additionally, the software features an auto-provisioning capability that lets unauthorized individuals create arbitrary new accounts, thereby establishing persistent access. This architectural error mirrors past trust-through-defaults issues seen in other enterprise identity systems.
Due to these severe security risks, the plugin was officially removed from the WordPress.org repository on September 4, 2026. As of the National Vulnerability Database publication on September 11, 2026, no official patched version has been released by developers. Consequently, site administrators cannot rely on a software update to remediate the flaw.
Recommended Remediation Steps
With no direct patch available, experts advise administrators to immediately uninstall and remove the plugin from their environments. Furthermore, because the vulnerability allows for the creation of arbitrary user accounts, webmasters must conduct comprehensive audits of their user databases. Any accounts created or modified during the active deployment of the plugin require strict scrutiny for suspicious activity.
Although there is currently no evidence of confirmed exploitation or a public proof-of-concept, the simplicity of the attack vector makes sites prime targets for automated scanning. Reviewing third-party authentication dependencies remains essential for maintaining security in identity-federated environments.
About The Author
