CVE-2026-12281 describes an improper authentication vulnerability (CWE-287) in the Shibboleth WordPress plugin versions prior to 2.5.4. When the HTTP header identity mode is enabled without an anti-spoofing key, the plugin fails to verify identity headers and treats any request carrying these headers as authenticated. This allows unauthenticated attackers to forge identity headers and gain administrative access if automatic account creation and default administrator role mapping are enabled. The vulnerability requires a deployment environment where untrusted client headers are not stripped before reaching the application, and the HTTP header attribute mode is enabled in a non-default configuration.

An unauthenticated attacker can bypass authentication by forging HTTP identity headers, potentially creating and signing in as a new administrator user. This leads to a complete compromise of the WordPress site with administrative privileges. The impact is conditional on specific plugin configurations and deployment environments that allow untrusted headers to reach the application without filtering.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should disable the HTTP header identity mode or ensure that an anti-spoofing key is configured. Additionally, deployments should be configured to strip or validate client-supplied headers before they reach the application. Disabling automatic account creation or changing default role mappings can also reduce risk.