CVE-2026-15013: The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3.

criticalpublic exploitCVSS 9.8CVE-2026-15013

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because Mo_SAML_Utilities::mo_saml_cast_key() reads the SignatureMethod Algorithm attribute directly from the attacker-controlled SAMLResponse parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.8
Published: 2026-07-16
Last updated: 2026-07-16
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-15013

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-150130.44% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 36% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-15013	coverage & exploitation status	NVD · CVE.org

Recent advisories for SAML Single Sign

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalCVE-2026-15981: The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypas…nvd · 2026-07-23
highCVE-2026-31982: An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to …nvd · 2026-07-09

CVE-2026-15013: The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3.

Details

Exploitation outlook

Referenced CVEs

Recent advisories for SAML Single Sign

More from NVD Recent CVEs