External risk intelligence

WordPress SAML SSO Plugin Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-15981

This vulnerability affects a SAML Single Sign-On plugin for WordPress. SAML SSO endpoints are designed to be public-facing to facilitate authentication via external identity providers, making the vulnerable authentication process accessible over the internet by design in normal deployments.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This critical vulnerability impacts WordPress sites using the SAML Single Sign-On plugin, allowing unauthenticated attackers to bypass security checks and log in as any user, including administrators. The issue lies in how the plugin verifies digital signatures, enabling malicious actors to exploit a flawed error handling mechanism. The main concern is confirming relevance and exposure to this broad attack vector.

Attackers bypass login to impersonate any user.
Critical access risk if the plugin is in use.
Verify plugin usage and exposure immediately.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can bypass login by sending a specially crafted SAML response to the WordPress SAML Single Sign-On plugin. This response tricks the plugin into believing the signature is valid, allowing the attacker to log in as any user, including administrators.

No prior access needed.
Crafted SAML response submitted.
Unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication and log in as any existing WordPress user. The issue arises when an attacker crafts a SAML response with specific malformed signature data that exploits a loose boolean check in the `mo_saml_validate_signature()` function, leading to successful authentication.

WordPress user accounts, including administrators.
Crafted SAML response submitted over the network.
Unauthorized access to user accounts and site content.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WordPress SAML SSO plugin's authentication bypass flaw requires immediate attention from application owners and platform teams responsible for WordPress environments. The first step is to identify all instances of this plugin, confirm their exposure to the internet, and verify if they are critical to business operations. This will inform risk-based remediation planning and potential vendor coordination.

Application owners and platform teams own remediation.
Verify plugin exposure and criticality first.
Plan targeted updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the SAML Single Sign On – SSO Login plugin for WordPress?

This plugin acts as a bridge between a WordPress site and an external identity provider. It allows users to log into their WordPress account using credentials managed by a separate service, such as those provided by corporate identity systems. By handling the SAML protocol, the plugin automates the verification of user identity, ensuring that only authenticated individuals gain access to the site's dashboard or member-only areas.

What does CVE-2026-15981 mean for site security?

This vulnerability is classified as an Improper Authentication issue, or CWE-287. It occurs because the plugin incorrectly evaluates security responses from the identity provider. Specifically, a programming error treats a specific type of cryptographic processing failure as a successful login. This allows an attacker to manipulate the authentication handshake to impersonate any user on the site without needing a valid password.

How can an attacker trigger this authentication bypass?

An attacker initiates the bypass by sending a specifically crafted SAML response to the WordPress site. They include a deliberately malformed signature that forces the plugin's verification function to return an error state. Because the software logic improperly interprets this specific error as a valid signal, it proceeds to grant full access. This attack does not require the user to have an existing account, legitimate credentials, or prior interaction with the site.

Is my site at risk if I use this plugin?

If you use the affected plugin, your site is at significant risk. According to Halo Surface Signal, because SAML SSO endpoints are intended to be accessible to identity providers, they are typically exposed to the public internet. This visibility means attackers can reach the vulnerable code directly without needing internal network access, making it a highly accessible target for unauthorized account takeovers.

What should I do first to address this vulnerability?

Your immediate priority is to identify all WordPress instances within your environment running this plugin. Once located, verify if these sites are internet-facing, as this increases the likelihood of exploitation. After cataloging your exposure, coordinate with your technical team to apply the vendor's provided update. If an update cannot be applied immediately, consider temporarily disabling the plugin to prevent unauthorized administrative access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.