CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-15013 — The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authen...

·Source: NIST NVD

Updated:

Executive Summary

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally co

Analysis

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover. CVSS Score: 9.8. Published: 2026-07-16T05:16:18.043.

Indicators of Compromise (1)

CVE (1)
CVE-2026-15013
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 16, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Lumin Digital raises $70 million from its clients

Cloud-native banking platform Lumin Digital has raised over $70 million in new capital from its own clients.

Finextra
CRITICALVulnerability

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; anyone on an earlier build should upgrade. Triggering it can crash or restart the worker, causing a denial of

CVE-2026-42533
The Hacker News
LOWVulnerability

Scans for Hikvision Intelligent Security API, (Sun, Jul 19th)

We have been following issues with Hikvision cameras for a long, long time. Like many similar products, Hikvision cameras have a long history of vulnerabilities and are often targeted by internet-wide scans that our honeypot network detects.

SANS ISC