CVE-2026-61979

This issue lets an attacker turn their initial access (no login needed) into full control of a WordPress site by exploiting a weakness in the SAML sign-in plugin. It’s like someone finding a master-key shortcut through the building’s door system and then taking over the office. Because it’s been seen being targeted in the wild, it can lead to account takeover, stolen access, and website disruption.

This matters if your business runs WordPress and has the “SAML SP Single Sign On” plugin installed and in use (especially versions at or below 5.4.3). The vulnerability is exploitable over the network without needing a login or user action. Given the reported opportunistic attempts across WordPress sites, treat it as a risk if the plugin is reachable and active in your WordPress environment.

This is a RED issue because attackers are actively attempting to exploit it in the wild to gain admin access. With no login required, an exposed WordPress site using this plugin is a realistic target during opportunistic scanning. Update immediately to remove the privilege escalation path.

1. Confirm exposure

   • In WordPress admin, check Plugins → Installed Plugins for “SAML SP Single Sign On”. Record the exact version.
   • Confirm whether the plugin is enabled/active (and whether it handles your SAML Single Sign On sign-in flow).

2. Verify if you might already be impacted (quick checks)

   • Check WordPress admin users for unexpected new admin accounts.
   • Review recent WordPress login activity (if you have it enabled) and any security/audit logs your host provides.
   • Look for unexpected changes to plugin settings related to SSO/SAML and any newly installed plugins or themes.

3. Patch

   • If the installed version is 5.4.3 or older, update the “SAML SP Single Sign On” plugin to at least 5.4.4 (use the latest available version per your WordPress plugin update options).

4. Post-upgrade validation

   • After updating, confirm the plugin shows the updated version and that WordPress site functionality still works.
   • Re-check for unexpected admin accounts or configuration changes.

5. If you can’t patch immediately (temporary workaround)

   • Disable the “SAML SP Single Sign On” plugin until the update to at least 5.4.4 is completed.
   • If disabling breaks your logins, coordinate a controlled maintenance window to patch as soon as possible.

6. What to monitor going forward

   • Ongoing attempts at unusual admin actions, new account creation, or changes to SSO/SAML configuration.
   • Any alerts your security plugin/hosting provider reports related to privilege changes or suspicious requests targeting WordPress endpoints.

Note: KEV listing was not provided for this CVE, but exploitation has been reported as observed in the wild.

Severity is high (CVSS 8.1 as provided). The weakness is CWE-266 (privilege escalation). Findings indicate an unauthenticated attacker can exploit the “SAML SP Single Sign On” plugin over the network to gain full administrative control, which would allow compromise of confidentiality, integrity, and availability. Reports (SecurityWeek/BleepingComputer) describe active opportunistic exploitation against WordPress sites, sometimes chained with a second CVE (CVE-2026-15981). No public exploit code was reported as available, and KEV listing for this CVE was not found; nevertheless, exploitation in the wild has been observed, which is treated as the decisive signal for urgency.