Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-16 | 3 | Disclosure1General1Patch1 |
| 2026-09-02 | 1 | Disclosure1 |
POSIWID: SAML is an extremely powerful protocol designed to create authentication bypass vulnerabilities. https://cvefeed.io/vuln/detail/CVE-2026-15013
Post summary
The tweet notes CVE-2026-15013 and points out that SAML may lead to authentication bypass, but no detailed technical, exploit, or mitigation information is provided.
CVE-2026-15013 is an unauthenticated auth bypass in miniOrange SAML SSO <= 5.4.3 for WordPress, exploiting HMAC signature algorithm confusion to forge a valid SAML assertion and gain admin access. #DFIR_Radar https://t.co/9YKo2daTmv
Post summary
The post announces a new unauthenticated authentication bypass in miniOrange SAML SSO versions <=5.4.3 for WordPress, caused by HMAC signature algorithm confusion that allows forging SAML assertions and gaining admin access.
🚨 CVE-2026-15013 — CVSS 9.8/10 ██████████ The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/HOZ1WIkF99
Post summary
The post alerts users to a critical authentication bypass flaw in the WordPress SAML SSO plugin, provides a CVSS score, and urges them to apply the patch.
CVE-2026-15013 Authentication Bypass via SAML Signature Algorithm Confusion in WordPress SAML SSO Plugin 5.4.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15013
Post summary
The content announces a newly identified authentication bypass in WordPress SAML SSO Plugin 5.4.3 caused by SAML signature algorithm confusion, but does not include exploitation details, PoC, or patch information.