Column 1
Skip to content

WordPress SAML SSO CVE-2026-75807: Security Update Checklist

August 29, 2026

WordPress SAML SSO CVE-2026-75807: Security Update Checklist

Update the miniOrange SAML Single Sign On – SSO Login plugin now. NVD lists CVE-2026-75807 as a high-severity authentication issue affecting plugin releases through 5.4.6. The official WordPress.org directory currently lists version 5.4.7, so site owners should move to that current release or a newer vendor-supported release and verify their sign-in flow during a planned maintenance window.

This is an identity and access-control update, not a reason to test a live site. Work with the person who manages your identity provider before making changes, especially when staff, members, customers, or multiple sites use single sign-on.

Who should act

Review this update if your WordPress site uses the SAML Single Sign On – SSO Login plugin from miniOrange. The plugin directory lists more than 10,000 active installations and the plugin supports common business identity-provider workflows, so an outdated installation can affect protected WordPress access even when the public site itself looks normal.

Safe update plan

  1. Confirm the installed plugin version and identify a site administrator who can recover access if the single sign-on connection needs attention.
  2. Record the current identity-provider settings and role-mapping decisions in your normal change record. Keep a tested recovery path for administrators before beginning maintenance.
  3. Use the WordPress dashboard or your managed WordPress update workflow to install version 5.4.7 or the current supported release from the official directory.
  4. Test a normal approved sign-in with a designated account, then confirm the expected WordPress role and access level are still applied.
  5. Review administrator accounts, privileged roles, and recent identity-related changes. Remove access that is no longer needed and keep WordPress core, plugins, themes, and server software current.

Keep the update from causing a login outage

SSO changes can affect several teams at once. Schedule the work with your identity owner, support desk, and any administrator responsible for WordPress recovery. Do not remove the only recovery administrator or make identity changes during an unstaffed maintenance period. If the update reveals a configuration problem, pause, preserve the change record, and use the plugin vendor’s supported support path instead of improvising access changes.

Layered WordPress protection

This update belongs in the larger routine of keeping login-related plugins current, limiting privileged access, and reviewing authentication changes after maintenance. For help coordinating WordPress updates and safe post-update checks, visit Fix I.T. Phill WordPress Support.

Sources and claim boundary

Public sources checked for this guide describe the affected version range and an available current WordPress.org release. This guide does not claim active exploitation and does not include proof material, request details, or reproduction instructions.