Authentication Bypass Vulnerability in SSO Login Plugin for WordPress

CVE-2026-15981

What is CVE-2026-15981?

The SAML Single Sign On – SSO Login plugin for WordPress has a vulnerability that allows unauthenticated attackers to bypass authentication mechanisms. This vulnerability arises from the mo_saml_validate_signature() function, which incorrectly evaluates the return value from PHP's openssl_verify() function. When an attacker crafts a SAMLResponse with a manipulated NameID and malformed signature, they can exploit this weakness to gain unauthorized access to existing WordPress user accounts, including those of administrators, leading to serious security breaches.

News Articles

The Hacker News

CVE-2026-15981

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Attackers are scanning for two miniOrange SAML flaws, including CVE-2026-15981, that can bypass login and grant WordPress admin access.

4 weeks ago

References