CVE-2026-15981: Critical Authentication Bypass in WordPress SAML SSO Plugin

Introduction

Defenders need to be on high alert for CVE-2026-15981, a critical vulnerability (CVSS 9.8) affecting the widely deployed "SAML Single Sign On – SSO Login" plugin for WordPress. This flaw introduces a severe authentication bypass mechanism, allowing unauthenticated actors to gain administrative privileges on affected sites remotely. Given the reliance on Single Sign-On (SSO) for managing access to corporate CMS instances, this vulnerability represents a privileged pathway into many organizations' web infrastructure. Immediate patching and network-level detection are non-negotiable.

Technical Analysis

Affected Products: SAML Single Sign On – SSO Login (WordPress Plugin by miniOrange).

Affected Versions: All versions up to and including 5.4.4.

Vulnerability Details: The vulnerability stems from a logic error in the mo_saml_validate_signature() function. The function utilizes PHP's openssl_verify() to validate the signature of a SAMLResponse. This PHP function is designed to return a tri-state integer:

• 1: Signature is correct.
• 0: Signature is incorrect.
• -1: An error occurred during verification.

The vulnerable code implements a loose boolean check (e.g., if (openssl_verify(...))) on this return value. In PHP's loose type comparison, any non-zero integer evaluates to true. Consequently, when openssl_verify() returns -1 (indicating an error), the plugin incorrectly interprets this as a successful verification (true).

Attack Chain:

1. An unauthenticated attacker sends a crafted HTTP POST request containing a malicious SAMLResponse to the WordPress SSO endpoint.
2. The SAMLResponse is intentionally malformed or uses invalid certificates to trigger a verification error within the OpenSSL library.
3. The mo_saml_validate_signature() function receives the -1 error code.
4. Due to the loose type comparison, -1 is treated as truthy.
5. The plugin assumes the signature is valid and authenticates the user.
6. The attacker gains access to the WordPress instance with the privileges of the user specified in the SAML assertion (typically an Administrator).

Exploitation Status: While specific CVE-2026-15981 is newly published, the simplicity of triggering the error state makes theoretical exploitation highly likely to transition to active scanning and exploitation in the wild imminently.

Detection & Response

Sigma Rules

The following Sigma rules detect potential exploitation attempts by identifying access to the vulnerable plugin paths and suspicious SAML assertion POST requests.

---
title: Potential WordPress SAML SSO Authentication Bypass
id: 8c4d2e10-1a3b-4c5d-9e6f-1a2b3c4d5e6f
status: experimental
description: Detects POST requests to the miniOrange SAML SSO plugin endpoint, indicative of SAML assertion processing which could be targeted for CVE-2026-15981.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15981
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-method|contains: 'POST'
    cs-uri-query|contains:
      - 'option=miniorange_saml_metadata'
      - 'saml_sso='
  condition: selection
falsepositives:
  - Legitimate SAML login attempts by valid users
level: medium
---
title: WordPress Plugin Directory Access - SAML SSO
id: 9f5e3f21-2b4c-5d6e-0f7a-2b3c4d5e6f7a
status: experimental
description: Identifies access to the specific directory structure of the vulnerable miniOrange SAML plugin, often used in reconnaissance or direct exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-15981
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    cs-uri-path|contains:
      - '/wp-content/plugins/saml-single-sign-on-sso-login/'
  condition: selection
falsepositives:
  - Administrative access to plugin files
level: low

KQL (Microsoft Sentinel / Defender)

Hunt for suspicious traffic targeting the SAML SSO endpoints in your web logs or CommonSecurityLog data.

// Hunt for POST requests to SAML SSO endpoints
CommonSecurityLog
| where RequestMethod == "POST"
| where RequestURL has "saml_sso" or RequestURL has "miniorange_saml"
| project TimeGenerated, DeviceName, SourceIP, RequestURL, RequestMethod, UserAgent
| order by TimeGenerated desc

Velociraptor VQL

This artifact hunts for the presence of the vulnerable plugin version on the disk by parsing the main plugin file header.

-- Hunt for vulnerable WordPress SAML SSO plugin versions
SELECT FullPath, Mtime, Size,
   parse_string(data=Data, regex='Version: (?P<Version>.*?)\n') AS Version
FROM read_file(filenames=glob(globs="/var/www/html/wp-content/plugins/saml-single-sign-on-sso-login/miniorange_saml_sso.php"))
WHERE Version <= "5.4.4" OR Version IS NULL

Remediation Script (Bash)

Use this script to audit your WordPress installations for the vulnerable plugin version.

#!/bin/bash

# Audit script for CVE-2026-15981
# Checks for vulnerable versions of miniOrange SAML SSO plugin

PLUGIN_DIR="wp-content/plugins/saml-single-sign-on-sso-login"
PLUGIN_FILE="$PLUGIN_DIR/miniorange_saml_sso.php"

# Define base WordPress directory if needed, or assume current
if [ -d "/var/www/html" ]; then
    BASE_DIR="/var/www/html"
else
    BASE_DIR="."
fi

echo "Scanning $BASE_DIR for vulnerable SAML SSO plugin..."

if [ -f "$BASE_DIR/$PLUGIN_FILE" ]; then
    # Extract version from the file header
    VERSION=$(grep -i "Version:" "$BASE_DIR/$PLUGIN_FILE" | head -n 1 | cut -d ':' -f2 | tr -d '[:space:]')
    echo "Found plugin version: $VERSION"

    # Compare versions (simple string comparison for this specific format)
    # Assuming standard semantic versioning, vulnerable if <= 5.4.4
    if [ "$VERSION" != "" ]; then
        # Use sort -V for proper version comparison if available, else manual check
        if [ "$VERSION" = "5.4.4" ] || [ "$VERSION" \< "5.4.4" ]; then
            echo "[ALERT] Vulnerable version $VERSION detected. Patch immediately."
            exit 1
        else
            echo "[INFO] Version $VERSION appears to be patched."
            exit 0
        fi
    else
        echo "[WARN] Could not determine plugin version. Manual check required."
        exit 2
    fi
else
    echo "[INFO] Plugin not found at standard path."
    exit 0
fi

Remediation

1. Immediate Update: Update the "SAML Single Sign On – SSO Login" plugin to the latest version immediately. The vendor has patched this issue in versions succeeding 5.4.4. Verify the update via the WordPress Admin Dashboard or via WP-CLI.
2. Disable Plugin: If an update is not immediately available, disable the plugin to prevent remote authentication attempts until a patch can be applied. This will break SSO functionality, so ensure alternative access (standard password auth) is available for administrators.
3. Review Logs: Audit WordPress access logs and user activity logs for any unusual administrative logins occurring around SSO authentication events during the timeframe the vulnerability was exposed.
4. Vendor Advisory: Consult the official miniOrange advisory or the WordPress Plugin Repository for the specific patched release notes.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub