If you’re running Frontegg’s SAML SSO plugin for WordPress, the practical impact is immediate: assume your login flow has been bypassable, not might-be-bypassable, and act today. The plugin is tracked as CVE-2026-75800, carries a maximum-severity CVSS score of 9.8, and affects every version up to and including 1.0.1. WordPress.org reportedly pulled it from the repository on 4 September 2026, with the NVD entry following on 11 September – and as things stand, there’s no patched release to update to. Removal, not remediation, is the only option on the table.
Step one: work out if you’re exposed
Image: Forkast.news
Before anything else, confirm whether the plugin is actually active on your site. Check your plugins list for “Frontegg SAML SSO” and note the version – anything up to 1.0.1 is affected, which in practice means everyone who installed it. SAML (Security Assertion Markup Language, the standard that lets an identity provider vouch for a user so your app never has to handle a password directly) is doing the authentication here, so if you’ve delegated login to this plugin, every account that could sign in through it is potentially exposed, not just admin accounts.
So what does “exposed” actually mean day to day? Anyone who could craft an HTTP request could potentially have walked in as any user on your site, admin included, without needing a password, a phishing email, or an existing account. That’s the bit worth sitting with for a second.
Step two: remove the plugin now
Deactivate and delete it. Don’t wait for a fix, because none exists yet, and don’t just flip SAML off in a settings panel and call it done – if the plugin’s authentication hooks remain registered, you haven’t closed anything, you’ve just stopped using the front door while leaving it unlocked. Full removal is the only version of “fixed” that’s currently available.
Step three: investigate accounts and logs
This is the step people skip, and it’s the one that actually tells you whether something happened. Here’s what to pull:
- New or modified user accounts. Sort your user list by registration date and flag anything created while the plugin was active, especially administrator or editor accounts you don’t recognise. Frontegg’s plugin reportedly auto-provisioned accounts on first login – useful for onboarding a design team without manual account creation, and exactly the mechanism an attacker would need to go from “forged login” to “persistent admin access” in one step.
- Role changes. Check whether any existing accounts had their capabilities escalated. An attacker who forges a session doesn’t always create a new user – sometimes it’s faster to quietly promote one that already exists.
- Login and server logs. Look for authentication requests hitting your SAML endpoint from unfamiliar IPs or at unusual hours, particularly around whatever date range the plugin was live. If your hosting setup logs raw POST data, check for SAML responses that don’t match your identity provider’s expected issuer.
- Plugin and theme file changes. If an attacker did get admin access, checking the user list is necessary but not sufficient – they may have installed a second plugin, edited a theme file, or added a scheduled task to keep access even after you remove the original vulnerability.
Step four: rotate credentials and sessions
Disabling the plugin stops new forgeries. It does nothing about sessions or credentials that may already be compromised. Think of it like changing the locks after finding out your old key had been copied – necessary, but only half the job if someone already has a spare.
Force-expire all active WordPress sessions, which logs everyone out and requires a fresh, legitimate login. Rotate passwords for any administrator or elevated accounts, and rotate API keys or application passwords if your site exposes a REST API, since those don’t get invalidated by a session reset. If your identity provider supports it, rotate the SAML signing certificate or metadata on that end too – not because the plugin checked it, but because a clean slate matters once you’re moving to a different (properly verifying) SSO integration.
If any of the accounts you flagged in step three had access to anything beyond the WordPress install itself – a hosting control panel, a payment processor, a connected email account – treat this as a broader incident, not a WordPress-only clean-up.
Why this happened: the missing checks
Here’s the root cause, and it’s almost disappointingly simple for a 9.8-severity bug: the plugin reportedly never verified the digital signature on incoming SAML responses, and never validated the issuer identifier either.
You might assume a plugin handling enterprise authentication gets the same scrutiny as, say, a caching plugin optimising page load times. It doesn’t, and that’s the myth worth busting here – security-critical code tends to get less casual attention than performance code, precisely because a slow page announces itself and a broken login check doesn’t. Nobody notices authentication silently failing open until someone exploits it.
In a correctly implemented SAML flow, the identity provider signs its response cryptographically, and your SSO plugin verifies that signature before trusting a single claim inside it – who the user is, what role they hold, whether the response even came from your actual identity provider rather than somewhere else entirely. Skip that verification, and the “assertion” is just an unsigned document the plugin takes on faith. Skip the issuer check too, and it doesn’t even need to come from your identity provider at all. An attacker can hand-craft the whole thing: claim to be an administrator, specify no issuer the plugin would reject, and get treated as authenticated. No credentials, no phishing, no social engineering – just a well-formed forged response.
That’s the gap between “it works in testing” and “it’s actually secure.” The login flow functioned exactly as designed every time someone used it legitimately, which is exactly why this went unnoticed for as long as it did.
For anyone evaluating SSO plugins after this – and you should be, if you’re not already – signature verification and issuer validation aren’t nice-to-haves buried in a feature list. They’re the entire point of SAML. A plugin that skips them isn’t offering a lighter-weight version of single sign-on; it’s offering no authentication at all, dressed up to look like one.
Frequently Asked Questions
Q: What is CVE-2026-75800?
A: A critical authentication bypass in the Frontegg SAML SSO plugin for WordPress, with a CVSS score of 9.8, that lets an unauthenticated attacker impersonate any user – including administrators – by submitting a forged SAML response.
Q: Which versions of the Frontegg SAML SSO plugin are affected?
A: All versions up to and including 1.0.1.
Q: Is there a patch for this vulnerability?
A: Not currently. The plugin was reportedly removed from the WordPress.org repository on 4 September 2026, and the NVD entry published on 11 September 2026 lists no fixed version. Removal is the only available remediation.
Q: Is disabling SAML login enough to fix this?
A: No. Disabling or deactivating the login flow stops new forgeries, but any sessions, accounts, or credentials created before you acted could already be compromised. You need to audit accounts and logs, then rotate sessions and credentials as a separate step.
Q: Why is this vulnerability so severe?
A: The plugin never verified the digital signature or issuer on incoming SAML responses, so an attacker could forge a response claiming to be an administrator. Combined with reported auto-provisioning behaviour, that forged claim could create a brand-new admin account outright, with no existing credentials needed.
Q: What should site owners do if they used this plugin?
A: Confirm the plugin was active and check its version, remove it completely rather than just disabling the feature, audit user accounts and logs for anything created or changed while it was live, and rotate sessions and credentials for any affected accounts.
This article was researched and written with AI assistance, then reviewed for accuracy and quality. Nia Campbell uses AI tools to help produce content faster while maintaining editorial standards.
Need help with your web project?
From one-day launches to full-scale builds, DRS Web Development delivers modern, fast websites.
