CVE-2026-75800
The Frontegg SAML SSO WordPress plugin through 1.0.1 does not verify the signature or issuer of SAML authentication responses before establishing a session, allowing unauthenticated attackers to log in as any user, including administrators, as well as to create arbitrary accounts.
- Published Sep 12, 2026
- CVSS 9.8 critical
- 0.6% chance of exploitation in the next 30 days (EPSS)