CVE-2025-7045
Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action
mediumMissing Authentication for Critical Function
6.5
CVSS Score
6.5
CVSS Score
medium
Severity
1.0.20
Patched in
1d
Time to patch
Description
The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. This makes it possible for unauthenticated attackers to delete any configured IdP, breaking the SSO authentication flow and causing a denial-of-service.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LAttack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
None
Confidentiality
Low
Integrity
Low
Availability
Technical Details
Affected versions
<=1.0.19PublishedSeptember 5, 2025
Last updatedSeptember 6, 2025
Affected plugincloud-sso-single-sign-on
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.