CVE-2026-15981

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

• CWE-287

• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-login-validate.php#L118
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-login-validate.php#L541
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/class-mo-saml-utilities.php#L403
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/includes/lib/SAML2Core/class-mo-saml-xml-security-dsig.php#L938
• https://plugins.trac.wordpress.org/browser/miniorange-saml-20-single-sign-on/tags/5.4.4/includes/lib/SAML2Core/class-mo-saml-xml-security-key.php#L621
• https://plugins.trac.wordpress.org/changeset/3611421/miniorange-saml-20-single-sign-on
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b412f60f-61ea-47b1-a3ef-17275f7951df?source=cve

Published

Jul 23, 2026

Last Modified

Jul 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-15976SGLang contains a RCE vulnerability when attempting to load …9.8
• CVE-2026-15977SGLang contains a credential leakage vulnerability in the /s…7.5
• CVE-2026-15978SGLang contains a model weight exfiltration vulnerability wh…7.5
• CVE-2026-15979The Content Egg – Affiliate Product Importer & Price Compari…8.1
• CVE-2026-1598A vulnerability was found in Bdtask Bhojon All-In-One Restau…5.4
• CVE-2026-15980The MyHome Core plugin for WordPress is vulnerable to Authen…9.8
• CVE-2026-15982The Aimogen Pro - All-in-One AI Content Writer, Editor, Chat…9.8
• CVE-2026-15984The QuickCal plugin for WordPress is vulnerable to Stored Cr…7.2
• CVE-2026-15985The Classified Listing - Mobile Number Verification plugin f…8.1
• CVE-2026-15988The AI Engine – The Chatbot, AI Framework & MCP for WordPres…8.8
• CVE-2026-1599A vulnerability was determined in Bdtask Bhojon All-In-One R…4.3
• CVE-2026-15990The Formidable Charts plugin for WordPress is vulnerable to …7.5