SAML SSO Login WordPress Plugin Vulnerable to Authentication Bypass
The SAML Single Sign On – SSO Login plugin for WordPress is under investigation for a critical vulnerability that reportedly allows unauthenticated attackers to bypass authentication and log in as any existing WordPress user, including administrators.
What happened
An early warning has been issued regarding a critical vulnerability in the SAML Single Sign On – SSO Login plugin for WordPress. The vulnerability, tracked as CVE-2026-15981, reportedly affects all versions up to and including 5.4.4. The issue appears to stem from the mo_saml_validate_signature() function, which performs a loose boolean check on the raw tri-state integer returned by PHP's openssl_verify(). This can cause an error return value of -1 to be evaluated as truthy, allowing an attacker to bypass signature verification by submitting a crafted SAMLResponse with a deliberately malformed signature. This would result in wp_set_auth_cookie() being called for the targeted account, enabling unauthorized access.
Professional software engineers using this plugin should immediately assess their exposure by checking if they are running a vulnerable version (up to and including 5.4.4). It is recommended to upgrade to the latest version of the plugin as soon as it becomes available. Additionally, reviewing access logs for any suspicious activity is advised. For the most accurate and up-to-date information, consult the primary sources linked in the threat data.
How 0Day mitigates this
saml single sign on – sso login plugin is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.