EUVD-2026-44866
GHSA-p847-q8vx-c3fg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRetrieve IdP public certificate from SAML metadata
-
DeliveryCraft forged assertion for admin account
-
ExploitSet SignatureMethod to HMAC-SHA1, sign with public key
-
InstallPOST SAMLResponse to plugin ACS endpoint
-
C2Plugin recasts RSA key as HMAC secret and validates
-
ExecuteReceive valid WordPress admin cookies
-
ImpactFull administrator account takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires only that the miniOrange SAML SSO plugin (≤5.4.3) is installed and active as a SAML Service Provider on the target WordPress site, and that the attacker knows the IdP's public signing certificate - which is normally published in SAML metadata and therefore not a meaningful secret. The attacker crafts a SAMLResponse whose SignatureMethod/@Algorithm attribute declares HMAC-SHA1, forcing the vulnerable mo_saml_cast_key() to reuse the public RSA key as the HMAC secret. Per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication or user-interaction barrier; the practical limiting factors are that the site must actually have SAML SSO enabled (not a default WordPress configuration) and the attacker must know which account (e.g. admin username/email) to target in the forged assertion. |
| Impact | This is a genuine top-priority issue, not an inflated high-CVSS score. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is internally consistent with the description: remote, unauthenticated (PR:N), no user interaction, low complexity, and full compromise of confidentiality, integrity and availability via administrator takeover. The only prerequisite - knowledge of the IdP's public signing certificate - is by design public information, so attack complexity remains genuinely low. No EPSS score, KEV listing, or SSVC decision data was provided, and there is no public exploit identified at time of analysis; the absence of KEV means exploitation is not confirmed in the wild, but the cryptographic simplicity of alg-confusion attacks and Wordfence's detailed write-up mean weaponization is plausible and defenders should not wait for an EPSS or KEV signal. No conflicting signals were found between the CVSS vector and the description. |
| Exploit ScenarioDerived | An attacker obtains the target site's IdP public signing certificate (routinely exposed in SP/IdP metadata), crafts a SAML assertion naming the site administrator, and signs it with HMAC-SHA1 using the public key bytes as the secret while setting the SignatureMethod algorithm to HMAC-SHA1 in the SAMLResponse. They POST the forged response to the plugin's ACS endpoint unauthenticated; the plugin recasts the RSA key as an HMAC secret, validates the forged signature, and issues valid WordPress admin cookies. No public exploit is identified at time of analysis, but the technique mirrors publicly documented JWT/SAML algorithm-confusion attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 16, 2026
Authentication bypass in the miniOrange SAML Single Sign On - SSO Login plugin for WordPress (all versions through 5.4.3) lets unauthenticated attackers forge SAML assertions and seize any account, including administrator. The plugin trusts the SignatureMethod algorithm declared inside the attacker-supplied SAMLResponse, enabling an RSA-to-HMAC signature confusion attack that yields valid WordPress auth cookies and full admin takeover. Reported by Wordfence; no public exploit identified at time of analysis, but the flaw is trivially exploitable and carries a 9.8 CVSS.
RemediationAI
Upstream fix available (changeset 3601345 in the WordPress plugin repository, https://plugins.trac.wordpress.org/changeset?old=3601345%40miniorange-saml-20-single-sign-on&new=3601345%40miniorange-saml-20-single-sign-on); a specific released patched version is not independently confirmed from the provided data, so upgrade to the latest available version of the plugin (any release beyond 5.4.3) as the primary fix and verify against the Wordfence advisory. If you cannot patch immediately, deactivate the miniOrange SAML SSO plugin to fully close the bypass - this disables SAML login and will break SSO for users, so provide an alternative login path first. As an interim compensating control, restrict access to the plugin's ACS/SAML login endpoint (e.g. via WAF or web-server allowlist limited to your IdP's egress IP ranges), noting this only raises the bar and does not fix the signature-validation flaw; Wordfence firewall rules may also provide virtual patching for detection of forged assertions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the miniOrange SAML 2.0 SSO login plugin (CPE cpe:2.3:a:cyberlord92:saml_single_sign_on_-_sso_login), which acts as a SAML Service Provider validating assertions from an external Identity Provider (IdP). SAML security depends on the SP verifying the XML Digital Signature over the assertion using the IdP's pre-configured public certificate. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): Mo_SAML_Utilities::mo_saml_cast_key() reads the SignatureMethod/@Algorithm attribute straight from the inbound SAMLResponse instead of pinning the locally configured algorithm. This is the SAML equivalent of the well-known JWT alg-confusion (RS256→HS256) attack - because the IdP's RSA public key is public knowledge, the plugin can be coerced into treating that public key as an HMAC-SHA1 shared secret, so an attacker who knows the public cert can compute a valid HMAC over a forged assertion and pass verification.
Know when Jwt Attack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated attacker (PR:N/UI:N) exploits algorithm confusion with only public-certificate knowledge (AC:L), yielding full admin takeover (C:H/I:H/A:H).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The SAML Single Sign On - SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because Mo_SAML_Utilities::mo_saml_cast_key() reads the SignatureMethod Algorithm attribute directly from the attacker-controlled SAMLResponse parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account - including administrators - obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.
Articles & Coverage 1
Executive ViewAI
The miniOrange SAML Single Sign On plugin for WordPress (versions through 5.4.3) contains a critical authentication bypass vulnerability that permits unauthenticated attackers to forge SAML assertions and seize any WordPress account, including administrator access. Organizations running this plugin face immediate risk of account takeover and full system compromise. This requires urgent incident response prioritization.
Immediately disable the miniOrange SAML SSO plugin and revert to alternative authentication mechanisms (LDAP, Active Directory, or established third-party SAML providers with demonstrated patching practices). If the plugin cannot be disabled operationally, restrict SAML assertion endpoints to whitelisted identity provider IP addresses and implement strict network segmentation. Monitor all WordPress user account creation, role elevation, and administrative login activity for unauthorized access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated a
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work