CVE-2026-75800, a critical vulnerability with a CVSS score of 9.8, allows unauthenticated attackers to bypass authentication in the Frontegg SAML SSO plugin for WordPress. By exploiting this flaw, an attacker can achieve full administrative takeover of any affected site. The vulnerability affects all versions of the plugin up to and including 1.0.1.
The root cause is a failure to implement standard SAML security checks. The plugin does not verify the digital signature of incoming SAML authentication responses, nor does it validate the issuer identifier. Because the plugin accepts these assertions without confirming their origin or integrity, an attacker can forge a SAML assertion to impersonate any existing user, including administrators. Furthermore, the plugin’s auto-provisioning feature allows attackers to create arbitrary new accounts, facilitating persistent unauthorized access.
This flaw represents a Citrix SAML trap style of failure, mirroring the trust-through-defaults issues seen in recent NetScaler SAML vulnerabilities. While the environment differs, the architectural error is identical: the system assumes any presented assertion is legitimate, effectively delegating security to the client. For a deeper understanding of this pattern, refer to the Golden SAML explainer.
The WordPress ecosystem frequently prioritizes ease of integration, which can lead to the omission of rigorous security controls in third-party plugins. Due to these security concerns, the Frontegg SAML SSO plugin was removed from the WordPress.org repository on September 4, 2026. As of the NVD publication on September 11, 2026, no fixed version of the plugin has been released, leaving administrators without a direct patch to remediate the flaw.
Remediation is limited to the immediate removal of the plugin. Because the vulnerability allows for the creation of arbitrary accounts, administrators must conduct a thorough audit of their user database. Any accounts created or modified while the plugin was active should be scrutinized for unauthorized activity. Relying on the plugin in its current state is not a viable security posture.
There is currently no evidence of confirmed exploitation or a public proof-of-concept. However, the absence of active exploitation does not diminish the risk. The simplicity of the attack vector makes it a high-value target for automated scanning and manual exploitation attempts. The lack of a fix means that the only effective defense is the complete removal of the vulnerable code from the environment.
This incident highlights the necessity of verifying the security architecture of third-party authentication plugins. Identity management is a critical component of site security, and delegating this responsibility to plugins requires a high degree of confidence in their implementation of standard protocols. When plugins fail to perform basic cryptographic verification, they transform a security feature into a significant vulnerability.
Administrators must treat authentication plugins with the same level of scrutiny as core system components. The reliance on default trust configurations is a recurring theme in authentication bypass vulnerabilities. Ensuring that every assertion is cryptographically verified and that the issuer is strictly validated remains the only way to maintain the integrity of an identity-federated environment.