CVE-2026-15981: WordPress SAML SSO Authentication Bypass (CVSS 9.8)

Executive Summary

The SAML Single Sign On – SSO Login plugin for WordPress (versions up to and including 5.4.4) contains a critical authentication bypass vulnerability assigned CVE-2026-15981 with a CVSS score of 9.8 (Critical). An unauthenticated attacker can craft a malicious SAMLResponse containing a forged or malformed signature that causes the plugin to grant a fully authenticated WordPress session for any existing account — including site administrators — without knowing any credentials.

The root cause is a loose boolean coercion applied to the tri-state integer returned by PHP's openssl_verify() function inside mo_saml_validate_signature().

Vulnerability Details

Root Cause

PHP's openssl_verify() returns three possible values:

The vulnerable code evaluates this return as a plain boolean. In PHP, -1 is truthy — so an OpenSSL processing error (such as a deliberately malformed signature or unsupported algorithm) causes the signature check to pass, as if the signature were legitimate.

Attack Chain

1. Attacker identifies WordPress site using SAML SSO – SSO Login plugin
2. Crafts a SAMLResponse with attacker-chosen NameID (any valid WP username/email)
3. Includes a signature designed to trigger an OpenSSL error state (returns -1)
4. Plugin evaluates openssl_verify() result as boolean — -1 is truthy
5. Signature validation passes despite the invalid signature
6. Plugin calls wp_set_auth_cookie() for the target account
7. Attacker is now authenticated as that user — including admins

Related Vulnerability

A sibling flaw, CVE-2026-15013 (also CVSS 9.8, affecting versions ≤ 5.4.3), targets the Mo_SAML_Utilities::mo_saml_cast_key() function. That function reads the SignatureMethod Algorithm attribute directly from the attacker-controlled SAMLResponse rather than enforcing the locally configured algorithm. This enables an algorithm-confusion attack: the attacker recasts the IdP's RSA public key as an HMAC-SHA1 shared secret, then forges a valid-looking HMAC-SHA1 signature accepted by the plugin.

Together, these two CVEs represent a complete breakdown of the plugin's signature validation pipeline.

Affected Versions

Immediate Remediation

1. Update the Plugin (Recommended)

Navigate to WordPress Admin → Plugins → Updates and update the SAML Single Sign On – SSO Login plugin to the latest version beyond 5.4.4. Alternatively, update via WP-CLI:

wp plugin update miniorange-saml-20-single-sign-on

2. Temporary Mitigation

If patching is not immediately possible:

• Disable the plugin entirely until the update can be applied
• Restrict the WordPress login page and SAML assertion endpoint to trusted IP ranges at the web server or WAF level
• Monitor authentication logs for unexpected logins, particularly administrator accounts

3. Post-Patch Actions

After updating:

• Audit recent administrator logins for anomalous sessions
• Rotate any privileged WordPress account passwords
• Review and revoke any suspicious application passwords or API tokens created during the exposure window

Detection

Look for Unexpected Admin Sessions

# WordPress debug log or server access log
# Look for wp-login.php and xmlrpc.php hits with unexpected session origins
grep "wp-login.php" /var/log/nginx/access.log | grep -v "your-idp-ip"

SIEM Query (Splunk)

index=web sourcetype=access_combined uri_path="/wp-login.php" OR uri_path="*saml*"
| stats count by src_ip, user_agent, status
| where status=302 AND count > 3

WAF Rule (ModSecurity)

# Block SAMLResponse without valid Referer from known IdP
SecRule REQUEST_URI "@contains SAMLResponse" \
  "id:2026159801,phase:2,deny,status:403,\
  msg:'Potential SAML Authentication Bypass Attempt',\
  logdata:'%{TX.MATCHED_VAR}'"

References

• NIST NVD — CVE-2026-15981
• Wordfence Security Advisory
• WPScan Plugin Vulnerability Database
• CVE-2026-15013 — Sibling Algorithm Confusion Flaw

Related Reading

• Apache Struts Critical RCE via OGNL Injection Returns
• BeyondTrust Remote Support Pre-Authentication RCE