Description
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.
References8
- plugins.trac.wordpress.org/browser/miniorange-saml-20-single-si…
- plugins.trac.wordpress.org/browser/miniorange-saml-20-single-si…
- plugins.trac.wordpress.org/browser/miniorange-saml-20-single-si…
- plugins.trac.wordpress.org/browser/miniorange-saml-20-single-si…
- plugins.trac.wordpress.org/browser/miniorange-saml-20-single-si…
- plugins.trac.wordpress.org/changeset?reponame=&old=3601345%40mi…
- www.wordfence.com/threat-intel/vulnerabilities/id/ee95092d-6351…
- seclists.org/fulldisclosure/2026/Aug/33
Metrics
- CVSS 3.1
-
9.8
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 2% percentile: 85 · as of 15 November 2026
- CWE
- CWE-347
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.