Source evidence

xmlseclibs vulnerability

WP SAML Auth · support · 2026-05-15T18:44:00+00:00

WP SAML Auth plugin evidence original source source API

neutralsentiment

highseverity

0.57relevance

3replies

Evidence linked to opportunitycommercial context

Proof Health

Open evidence

Commercial opportunities need traceable source links before they are treated as build-worthy.

5 / 25 rows with source links

20.0% of this page's analysis has direct source links.

0 build-decision rows missing links

0 rows here require auditable proof before promotion.

20 rows with no attached evidence

0 rows have source counts but still need direct links.

Conversation

support

kkatpcc resolved

There was a vulnerability in xmlseclibs as described at https://portswigger.net/research/the-fragile-lock . The vulnerability was fixed in xmlseclibs version 3.1.4: https://github.com/robrichards/xmlseclibs/compare/3.1.3…3.1.4#diff-7ad661ed1d8158bb5c6595db86ba0073f5c3e120ab8bedfdfaea81732e4b4b95L296-R300 However, this official WP plugin still indicates use of version 3.1.3 of that indirect (via onelogin/php-saml) xmlseclibs dependency: https://plugins.trac.wordpress.org/browser/wp-saml-auth/trunk/vendor/robrichards/xmlseclibs/src/XMLSecurityDSig.php#L296 The direct onelogin/php-saml dependency addressed that in December: https://github.com/SAML-Toolkits/php-saml/releases/tag/4.3.1 Is this plugin technically still vulnerable? If not, cool. If so, why wasn’t something this critical caught/patched months ago, and how can that oversight be prevented in the future? Also, now there is another vulnerability, and xmlseclibs 3.1.5 addresses that, which is already reflected in onelogin/php-saml version 4.3.2: https://github.com/SAML-Toolkits/php-saml/releases/tag/4.3.2 This topic was modified 1 month, 3 weeks ago by kkatpcc . Hi @kkatpcc , Thank you for reporting this. A PR has been created with the needed fixes, and this will be shipped first thing next week. We apologize for this situation and appreciate your patience. 👍 Thanks again @kkatpcc , version 2.3.2 has been released with security fixes for vulnerabilities in the robrichards/xmlseclibs and onelogin/php-saml dependencies. Please update when you get a chance.

Commercial Context

Opportunity

trust and abuse-prevention operations

Authentication abuse-prevention assurance for keeping sites trusted, protected, and recoverable

Buyer: site owners, agencies, and maintenance teams

Wedge: test authentication lockouts, bot/spam defenses, risky access changes, and incident alerts

Proof Blocked card complete market

Analysis

heuristic-v1

Summary: xmlseclibs vulnerability: users show security, compatibility pain that may indicate a product gap.

Evidence quote: xmlseclibs vulnerability There was a vulnerability in xmlseclibs as described at https://portswigger.net/research/the-fragile-lock .

Affected feature: security

security compatibility

Plugin

API

WP SAML Auth

8.0K active installs · 215.3K downloads · rating 90.0

authentication saml

Comments

3 shown

Anais Pantheor 2026-05-15T21:30:00+00:00

Hi @kkatpcc , Thank you for reporting this. A PR has been created with the needed fixes, and this will be shipped first thing next week. We apologize for this situation and appreciate your patience.

kkatpcc 2026-05-18T20:05:00+00:00

👍

Anais Pantheor 2026-05-20T16:58:00+00:00

Thanks again @kkatpcc , version 2.3.2 has been released with security fixes for vulnerabilities in the robrichards/xmlseclibs and onelogin/php-saml dependencies. Please update when you get a chance.