SAML Single Sign On – SSO Login Plugin Vulnerability (CVE-2026-15013)

Security Alert Summary

The SAML Single Sign On – SSO Login plugin for WordPress contains an authentication bypass attributable to SAML signature algorithm confusion. An attacker can supply a malicious SAMLResponse that causes the plugin to treat an RSA public key as an HMAC-SHA1 secret, allowing forged assertions to validate and produce valid WordPress authentication cookies, including for administrator accounts.

CVE Details

• CVE ID: CVE-2026-15013
• Affected component: SAML Single Sign On – SSO Login plugin for WordPress
• Affected versions: All versions up to and including 5.4.3
• Published: July 16, 2026 at 05:16:18 AM UTC
• Last modified: July 16, 2026 at 01:38:53 PM UTC
• CVSS v3.1: Base Score 9.8, Severity CRITICAL, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Authentication / Privileges / User interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK
• Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
• CWE / weakness: CWE-347

Technical Details

The vulnerability exists because the plugin function Mo_SAML_Utilities::mo_saml_cast_key() reads the SignatureMethod Algorithm attribute directly from the attacker-controlled SAMLResponse instead of enforcing the locally configured signature algorithm. By doing so, the implementation can recast the Identity Provider (IdP) RSA public key as an HMAC-SHA1 shared secret. An attacker can craft a SAMLResponse that uses the HMAC-SHA1 algorithm value and then generate a forged signature that validates against the recast key.

Successful exploitation allows an unauthenticated attacker to forge a SAML assertion for any WordPress account, including administrators, obtain valid WordPress authentication cookies, and thereby achieve administrative account takeover according to the provided report.

How This Could Impact Your Website

In a typical small-to-medium site, multiple people interact with the WordPress admin: a site owner, internal staff such as editors or content managers, and external contractors or contributors. If this plugin is present and unpatched, an attacker could forge a SAML assertion that impersonates any of those accounts. Practical consequences include unauthorized administrative access, exposure of administrative interfaces, and the ability to modify content or user records.

Even if the attacker targets non-administrative accounts initially, access to internal email addresses and user lists can increase the risk of targeted phishing or social engineering against staff and contractors. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

• Update the affected plugin as soon as a patched version is available.
• Review and reduce unnecessary user roles, especially contributors and other accounts with elevated privileges.
• Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
• Remove unused or unmaintained plugins from the site.
• Monitor site activity and authentication logs for unusual login events or new administrative sessions.

If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-login-validate.php#L119
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-utilities.php#L416
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-utilities.php#L444
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-utilities.php#L561
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/includes/lib/SAML2Core/class-mo-saml-xml-security-key.php#L722
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3601345%40miniorange-saml-20-single-sign-on&new=3601345%40miniorange-saml-20-single-sign-on
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ee95092d-6351-4612-872d-284165bc1201?source=cve