SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion

Wordfence Intelligence   >   Vulnerability Database   >   SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
9.8
Improper Verification of Cryptographic Signature
CVE CVE-2026-15013
CVSS 9.8 (Critical)
Publicly Published July 15, 2026
Last Updated July 16, 2026
Researcher lhking

Description

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.

References

Share

Vulnerability Details for SAML Single Sign On – SSO Login

SAML Single Sign On – SSO Login

Software Type Plugin
Software Slug miniorange-saml-20-single-sign-on (view on wordpress.org)
Patched? Yes
Remediation Update to version 5.4.4, or a newer patched version
Affected Version
  • <= 5.4.3
Patched Version
  • 5.4.4

Recent vulnerabilities in SAML Single Sign On – SSO Login

SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter
9.8
CVE-2026-15981
Jul 23, 2026
Researcher: Supakiad S. (m3ez)
SAML Single Sign On – SAML SSO Login <= 4.9.20 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Jun 6, 2022
Researchers:
SAML Single Sign On – SAML SSO Login <= 4.8.83 - Cross-Site Scripting
6.1
CVE-2020-6850
Jan 28, 2020
Researcher: Zeroauth
SAML Single Sign On – SAML SSO Login < 4.8.73 - Cross-Site Scripting
6.1
CVE-2019-12346
May 27, 2019
Researcher: Zeroauth
SAML Single Sign On – SAML SSO Login <= 4.8.75 - Cross-Site Request Forgery
8.8
CVE ID Unknown
May 20, 2019
Researchers:
# Title CVE ID CVSS Researchers Date
1 SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter CVE-2026-15981 9.8 Supakiad S. (m3ez) July 23, 2026
2 SAML Single Sign On – SAML SSO Login <= 4.9.20 - Reflected Cross-Site Scripting 6.1 June 6, 2022
3 SAML Single Sign On – SAML SSO Login <= 4.8.83 - Cross-Site Scripting CVE-2020-6850 6.1 Zeroauth January 28, 2020
4 SAML Single Sign On – SAML SSO Login < 4.8.73 - Cross-Site Scripting CVE-2019-12346 6.1 Zeroauth May 27, 2019
5 SAML Single Sign On – SAML SSO Login <= 4.8.75 - Cross-Site Request Forgery 8.8 May 20, 2019
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation