CVE-2016-10928: The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

high Affects onelogin-saml-sso (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2019-08-22; advisory modified 2026-06-17.

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

Package: onelogin-saml-sso (WordPress plugin) WordPress
Affected versions: <2.2.0
Fixed in: 2.2.0
Severity: high CVSS 7.5
Exploitation: not on CISA KEV · EPSS 2% (76.8th percentile)
Published: 2019-08-22
Source: nvd

References

CWE-798

NVD record onelogin-saml-sso (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2020-35296 high ThinkAdmin Admin Panel Access using Default Credentials same weakness: CWE-798
CVE-2019-15867 high The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13# password for same weakness: CWE-798
CVE-2026-55579 critical Pheditor: Hardcoded default password 'admin' with no forced change enables full applicatio same weakness: CWE-798
CVE-2023-1269 critical Easy!Appointments uses hard-coded credentials same weakness: CWE-798
CVE-2023-5318 medium Microweber uses hard coded credentials same weakness: CWE-798
CVE-2024-13688 medium The Admin and Site Enhancements (ASE) WordPress plugin before 7.6.10 uses a hardcoded pass same weakness: CWE-798