CVE-2026-15013: CYBERLORD92 SAML Single Sign On – SSO Login

Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days.

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.

Affected products

• CYBERLORD92 SAML Single Sign On – SSO Login: up to and including 5.4.3

Published 2026-07-16. Last modified 2026-08-07.