CVE-2026-15013
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The SAML Single Sign On – SSO Login plugin for WordPress up to version 5.4.3 contains an authentication bypass vulnerability due to SAML signature algorithm confusion. The `Mo_SAML_Utilities::mo_saml_cast_key()` function reads the `SignatureMethod` algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter instead of enforcing the locally configured algorithm, allowing the attacker to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate a forged signature.
Risk Assessment
An unauthenticated attacker can forge a SAML assertion for any WordPress account, including administrators, obtain valid authentication cookies, and achieve full administrator-level account takeover, leading to complete site compromise.
Recommendation
Immediately update the SAML Single Sign On – SSO Login plugin to the latest available version that fixes this vulnerability and enforce server-side signature algorithm configuration.
Original NVD description (English source)
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.