Authentication Bypass in Shibboleth WordPress Plugin
CVE-2026-12281
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 July 2026
Badges
What is CVE-2026-12281?
The Shibboleth plugin for WordPress before version 2.5.4 is vulnerable to an authentication bypass due to a flaw in its HTTP header identity mode. When this mode is activated without an anti-spoofing key, the plugin erroneously authenticates any request carrying identity headers without proper verification. This vulnerability allows an unauthenticated attacker to impersonate an authenticated user by sending forged identity headers. If the configuration allows for automatic account creation and has default role mappings enabled, this exploit could lead to the unauthorized creation of an administrator account. The risk increases in environments where untrusted client headers are not stripped before reaching the application.
Affected Version(s)
Shibboleth 0 < 2.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.