A critical flaw in the SAML Single Sign On – SSO Login plugin for WordPress lets unauthenticated attackers log in as any user, including administrators, by submitting a crafted, deliberately malformed SAML signature.
What Is It
CVE-2026-15981 is an authentication bypass (CWE-287) in the "SAML Single Sign On – SSO Login" WordPress plugin by cyberlord92. The plugin's mo_saml_validate_signature() function performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(). Because that function can return -1 on an OpenSSL processing error, and -1 evaluates as truthy, an error return is treated as a successful signature verification. An attacker can submit a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature that triggers an OpenSSL error, bypassing verification entirely and causing wp_set_auth_cookie() to be called for the targeted account.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It is network-exploitable with low complexity, requires no privileges and no user interaction, and yields high impact to confidentiality, integrity, and availability. Successful exploitation grants full authentication as any existing WordPress user, including administrators, giving an unauthenticated attacker complete control over affected sites.
What's Vulnerable
- Vendor: cyberlord92
- Product: SAML Single Sign On – SSO Login (WordPress plugin)
- Affected versions: All versions up to and including 5.4.4.
Patch Status
The supplied source data does not include a CISA KEV entry for this CVE, so there is no confirmation of active exploitation at this time. The NVD record is newly published (2026-07-23) with status "Received." A code changeset (3611421) is referenced in the plugin's WordPress repository; administrators should update to a fixed release above 5.4.4 once available and review sites for unauthorized administrator logins.