CVE-2016-10928

HIGH

onelogin_saml_sso < 2.2.0 - Use of Hard-coded Credentials

Title source: llm

The onelogin-saml-sso plugin before 2.2.0 for WordPress has a hardcoded @@@nopass@@@ password for just-in-time provisioned users.

Core 2

Core References

Release Notes x_refsource_misc

Patch, Third Party Advisory x_refsource_misc

CVSS v3 7.5

EPSS 0.0168

EPSS Percentile 73.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-798

Status published

Products (1)

onelogin/onelogin_saml_sso < 2.2.0

Published Aug 22, 2019

Tracked Since Feb 18, 2026