What is the CVSS score of CVE-2026-12281?

CVE-2026-12281 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Shibboleth are affected by CVE-2026-12281?

The Shibboleth WordPress plugin (versions before 2.5.4) contains an authentication bypass vulnerability enabling unauthenticated remote attackers to create administrator accounts and assume complete…. A patch is available.

Is there a public PoC exploit available for CVE-2026-12281?

Yes, a public proof-of-concept exploit is available for CVE-2026-12281. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12281?

Within 24 hours, inventory all WordPress installations using the Shibboleth plugin, identify versions prior to 2.5.4, and evaluate disabling HTTP header identity mode to eliminate the attack vector until patching is possible. Within 7 days, update the Shibboleth WordPress plugin to version 2.5.4 or later across all affected sites and audit administrator accounts for any unauthorized access created during the vulnerability window. Within 30 days, review access logs for exploitation evidence, establish ongoing monitoring for suspicious administrative account creation, and document the incident timeline for compliance and security posture assessment.

Shibboleth CVE-2026-12281

EUVD-2026-44594 HIGH

Improper Authentication (CWE-287)

2026-07-15 WPScan

GHSA-x945-qvjm-5rqp

Authentication Bypass WordPress Shibboleth

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 11:23 vuln.today

CVSS changed

Jul 15, 2026 - 11:22 NVD

8.1 (HIGH)

Patch available

Jul 15, 2026 - 07:02 EUVD

CVE Published

Jul 15, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Jul 15, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automatic account creation and the default administrator role mapping are enabled, create and sign in as a new administrator. Exploitation requires the non-default HTTP header attribute mode, an empty or absent spoof key, automatic account creation enabled, and a deployment that does not strip untrusted client headers before they reach the application.

Articles & Coverage 1

News 4 New WordPress Vulnerabilities - 4 High Severity, 2 With POC Jul 16, 2026

AnalysisAI

Authentication bypass in the Shibboleth WordPress plugin before 2.5.4 lets remote unauthenticated attackers forge identity headers and log in when the HTTP header identity mode is enabled without an anti-spoofing key. Because the plugin fails open rather than closed, any request carrying identity headers is trusted as an authenticated session, and with automatic account creation plus the default administrator role mapping an attacker can provision and sign in as a brand-new administrator. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all WordPress installations using the Shibboleth plugin, identify versions prior to 2.5.4, and evaluate disabling HTTP header identity mode to eliminate the attack vector until patching is possible. …

Threat intelligence, references, and detailed analysis are available after sign-in.