WordPress security changelog
CRITICAL CVE-2026-15981 Awaiting Analysis

miniOrange SAML signature errors permit administrator login

SAML Single Sign On – SSO Login through 5.4.4 accepts a crafted public SAMLResponse because Mo_SAML_Utilities::mo_saml_validate_signature() treats the tri-state openssl_verify() result as a boolean. A deliberately malformed signature can make OpenSSL return -1, which the vulnerable code accepts as success; the attacker-controlled NameID then reaches mo_saml_login_user() and wp_set_auth_cookie(), allowing login as an existing user, including an administrator.

CVE / CNA score 9.8 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
SAML Single Sign On – SSO Login
Plugin slug
miniorange-saml-20-single-sign-on
Affected
<= 5.4.4
Safe version
5.4.5
Published
Jul 23, 2026
Weakness
CWE-287 — Improper Authentication

This CVE was published Jul 23, 2026 and is one of 4 known issues for this plugin.

What to do

Update, patch or deactivate.

Update SAML Single Sign On – SSO Login to 5.4.5 or later. For an application-level backport, require openssl_verify() to return exactly 1 and reject certificate-key/signature-algorithm mismatches before verification. Review administrator accounts and SSO login records for unexpected identities.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(), causing an error return value of -1 to be evaluated as truthy and therefore treated as a successful signature verification. This makes it possible for unauthenticated attackers to log in as any existing WordPress user, including administrators, by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL processing error — bypassing verification entirely and resulting in wp_set_auth_cookie() being called for the targeted account.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources