EUVD-2026-44866
GHSA-p847-q8vx-c3fg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated attacker (PR:N/UI:N) exploits algorithm confusion with only public-certificate knowledge (AC:L), yielding full admin takeover (C:H/I:H/A:H).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The SAML Single Sign On - SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because Mo_SAML_Utilities::mo_saml_cast_key() reads the SignatureMethod Algorithm attribute directly from the attacker-controlled SAMLResponse parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account - including administrators - obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.
Technical ContextAI
The affected component is the miniOrange SAML 2.0 SSO login plugin (CPE cpe:2.3:a:cyberlord92:saml_single_sign_on_-_sso_login), which acts as a SAML Service Provider validating assertions from an external Identity Provider (IdP). SAML security depends on the SP verifying the XML Digital Signature over the assertion using the IdP's pre-configured public certificate. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): Mo_SAML_Utilities::mo_saml_cast_key() reads the SignatureMethod/@Algorithm attribute straight from the inbound SAMLResponse instead of pinning the locally configured algorithm. This is the SAML equivalent of the well-known JWT alg-confusion (RS256→HS256) attack - because the IdP's RSA public key is public knowledge, the plugin can be coerced into treating that public key as an HMAC-SHA1 shared secret, so an attacker who knows the public cert can compute a valid HMAC over a forged assertion and pass verification.
RemediationAI
Upstream fix available (changeset 3601345 in the WordPress plugin repository, https://plugins.trac.wordpress.org/changeset?old=3601345%40miniorange-saml-20-single-sign-on&new=3601345%40miniorange-saml-20-single-sign-on); a specific released patched version is not independently confirmed from the provided data, so upgrade to the latest available version of the plugin (any release beyond 5.4.3) as the primary fix and verify against the Wordfence advisory. If you cannot patch immediately, deactivate the miniOrange SAML SSO plugin to fully close the bypass - this disables SAML login and will break SSO for users, so provide an alternative login path first. As an interim compensating control, restrict access to the plugin's ACS/SAML login endpoint (e.g. via WAF or web-server allowlist limited to your IdP's egress IP ranges), noting this only raises the bar and does not fix the signature-validation flaw; Wordfence firewall rules may also provide virtual patching for detection of forged assertions.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today