EUVD-2026-44594
GHSA-x945-qvjm-5rqp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Authentication bypass in the Shibboleth WordPress plugin before 2.5.4 lets remote unauthenticated attackers forge identity headers and log in when the HTTP header identity mode is enabled without an anti-spoofing key. Because the plugin fails open rather than closed, any request carrying identity headers is trusted as an authenticated session, and with automatic account creation plus the default administrator role mapping an attacker can provision and sign in as a brand-new administrator. Rated CVSS 8.1 (CWE-287); publicly available exploit code exists (WPScan), but it is not listed in CISA KEV.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Shibboleth gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automatic account creation and the default administrator role mapping are enabled, create and sign in as a new administrator. Exploitation requires the non-default HTTP header attribute mode, an empty or absent spoof key, automatic account creation enabled, and a deployment that does not strip untrusted client headers before they reach the application.
Articles & Coverage 1
Executive ViewAI
The Shibboleth WordPress plugin (versions before 2.5.4) contains an authentication bypass vulnerability enabling unauthenticated remote attackers to create administrator accounts and assume complete control of affected WordPress sites. Organizations using this plugin for identity management face immediate risk of unauthorized administrative access, content manipulation, and potential data exposure. Publicly available exploit code exists, making this vulnerability readily exploitable without advanced technical capability.
Within 24 hours, inventory all WordPress installations using the Shibboleth plugin, identify versions prior to 2.5.4, and evaluate disabling HTTP header identity mode to eliminate the attack vector until patching is possible. Within 7 days, update the Shibboleth WordPress plugin to version 2.5.4 or later across all affected sites and audit administrator accounts for any unauthorized access created during the vulnerability window. Within 30 days, review access logs for exploitation evidence, establish ongoing monitoring for suspicious administrative account creation, and document the incident timeline for compliance and security posture assessment.
Disable HTTP header identity mode in Shibboleth plugin configuration to eliminate the attack surface pending patch deployment. Monitor WordPress user creation and administrative account logs for suspicious activity. Apply vendor patch: Shibboleth WordPress plugin version 2.5.4 or later.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Shibboleth
View allShibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyIn
Shibboleth Service Provider (SP) 3.x before 3.1.0 shipped a spec file that calls chown on files in a directory controlle
Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery
Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an u
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML befo
shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before
Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. Rated high severity (CVSS 7.5), this vulnera
Shibboleth XMLTooling-C before 1.6.4, as used in Shibboleth Service Provider before 2.6.1.4 on Windows and other product
Shibboleth XMLTooling-C before 1.6.3, as used in Shibboleth Service Provider before 2.6.0 on Windows and other products,
The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XS
Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled p
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Jav
Exploit-DB