CVE-2025-7040

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-7040 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-7045

CVE-2025-7045 refers to the Cloud SAML SSO WordPress plugin, where a missing capability check on the delete_config action in csso_handle_actions() allows unauthenticated Identity Provider deletions, potentially breaking SSO and causing a denial-of-service. Multiple connected sources confirm affec...

CVE-2025-7040

The Wordfence Vulnerability (CVE-2025-7040) affects the Cloud SAML SSO plugin for WordPress up to version 1.0.19. The issue is a missing capability check on the set_organization_settings action inside csso_handle_actions(), allowing unauthenticated attackers to submit POST data that is passed dir...

WordPress Cloud SAML SSO plugin <= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set_organization_settings Action vulnerability

Missing Authorization to Unauthenticated Settings Modification via setorganizationsettings Action vulnerability discovered by kr0d in WordPress Plugin Cloud SAML SSO - Single Sign On Login versions = 1.0.19...

WordPress Cloud SAML SSO plugin <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action vulnerability

Missing Authorization to Unauthenticated Identity Provider Deletion via deleteconfig Action vulnerability discovered by kr0d in WordPress Plugin Cloud SAML SSO - Single Sign On Login versions = 1.0.19...

CVE-2025-7040: Missing Authorization

The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'setorganizationsettings' action of the cssohandleactions function in all versions up to, and including, 1.0.19. The handler reads client-supplied POST parameters fo...

CVE-2025-7045: Missing Authentication for Critical Function

The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the deleteconfig action of the cssohandleactions function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any...

CVE-2025-49264: Improper Control of Filename for Include/Require Statement in PHP Program

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login cloud-sso-single-sign-on allows PHP Local File Inclusion.This issue affects Cloud SAML SSO - Single Sign On...