CVE-2016-10928

2019-08-2220:15:11

Google

osv.dev

7.4 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

55.2%

JSON

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

CPENameOperatorVersion
wordpress-samleq2.1.5
wordpress-samleq2.1.2
wordpress-samleq2.1.8
wordpress-samleq2.1.1
wordpress-samleq2.1.7
wordpress-samleq2.1.6
wordpress-samleq2.1.3
wordpress-samleq2.1.0
wordpress-samleq2.0.0b
wordpress-samleq2.1.4

Name	Operator	Version
wordpress-saml	eq	2.1.5
wordpress-saml	eq	2.1.2
wordpress-saml	eq	2.1.8
wordpress-saml	eq	2.1.1
wordpress-saml	eq	2.1.7
wordpress-saml	eq	2.1.6
wordpress-saml	eq	2.1.3
wordpress-saml	eq	2.1.0
wordpress-saml	eq	2.0.0b
wordpress-saml	eq	2.1.4