CVE-2026-15013

Name of the Vulnerable Software and Affected Versions SAML Single Sign On – SSO Login plugin for WordPress versions prior to 5.4.4

Description An authentication bypass exists due to SAML Signature Algorithm Confusion. The issue occurs because the Mo SAML Utilities::mo saml cast key() function reads the SignatureMethod attribute directly from the attacker-controlled SAMLResponse parameter instead of using the locally configured algorithm. This allows the plugin to treat the Identity Provider's RSA public key as an HMAC-SHA1 shared secret to validate a forged signature. Consequently, unauthenticated attackers can forge SAML assertions for any account, including administrators, to obtain authentication cookies and achieve full account takeover.

Recommendations Update the plugin to a version newer than 5.4.3.