CVE-2025-7040
Published: 06 September 2025
Summary
CVE-2025-7040 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-7040, published on 2025-09-06, is an unauthorized modification of data vulnerability in the Cloud SAML SSO plugin for WordPress, affecting all versions up to and including 1.0.19. The issue arises from a missing capability check on the 'set_organization_settings' action within the csso_handle_actions() function. This handler processes client-supplied POST parameters for organization settings and passes them directly to WordPress's update_option() without validating the user's capabilities or including a CSRF nonce check. The vulnerability carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L) and maps to CWE-862 (Missing Authorization).
Unauthenticated attackers can exploit this vulnerability remotely with low attack complexity and no user interaction required. By submitting crafted POST requests to the affected endpoint, they can arbitrarily alter critical plugin configurations, such as toggling SAML signing and encryption settings. This can disrupt the single sign-on (SSO) workflow, potentially leading to a denial-of-service condition by breaking authentication flows for legitimate users.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-34021
Vulnerability details
The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings' action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. The handler reads client-supplied…
more
POST parameters for organization settings and passes them directly to update_option() without any check of the user’s capabilities or a CSRF nonce. This makes it possible for unauthenticated attackers to change critical configuration (including toggling signing and encryption), potentially breaking the SSO flow and causing a denial-of-service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing auth on SAML config handler enables remote exploitation of public app (T1190) and direct tampering of auth settings (T1556) that produces auth-flow DoS (T1499).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations on functions like set_organization_settings, directly preventing unauthenticated modification of plugin configurations.
Restricts access to configuration changes such as organization settings updates to authorized personnel, mitigating unauthorized POST-based alterations.
Implements least privilege to ensure unauthenticated users cannot perform privileged actions like toggling SAML signing and encryption settings.