PT-2026-60407 · WordPress · Saml Single Sign On – Sso Login

Lhking · Published 2026-07-16 · Updated 2026-07-16 · CVE-2026-15013

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.4

Description An authentication bypass exists due to SAML Signature Algorithm Confusion. The Mo SAML Utilities::mo saml cast key() function reads the SignatureMethod attribute directly from the attacker-controlled SAMLResponse parameter instead of enforcing the locally configured algorithm. This allows the plugin to recast the Identity Provider's RSA public key as an HMAC-SHA1 shared secret and validate a forged signature against it. Consequently, unauthenticated attackers can forge a SAML assertion for any account, including administrators, to obtain valid authentication cookies and achieve full account takeover.

Recommendations Update the plugin to version 5.4.4 or later.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-15013

Affected Products

Saml Single Sign On – Sso Login

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-15013 · Security Note
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-login-validate.php#L119 · Note
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-utilities.php#L561 · Note
• https://twitter.com/OrizonCyber/status/2077626799610073336 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3601345%40miniorange-saml-20-single-sign-on&new=3601345%40miniorange-saml-20-single-sign-on · Note
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-utilities.php#L416 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ee95092d-6351-4612-872d-284165bc1201?source=cve · Note
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/includes/lib/SAML2Core/class-mo-saml-xml-security-key.php#L722 · Note
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.3/class-mo-saml-utilities.php#L444 · Note