CVE-2026-15013 is a critical vulnerability in the cyberlord92 SAML Single Sign On – SSO Login WordPress plugin affecting all versions up to and including 5.4.3. The vulnerability arises from improper verification of cryptographic signatures (CWE-347). Specifically, the function Mo_SAML_Utilities::mo_saml_cast_key() reads the SignatureMethod Algorithm attribute directly from the attacker-controlled SAMLResponse parameter rather than enforcing the locally configured algorithm. This flaw allows an attacker to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate a forged signature, enabling authentication bypass and full administrator-level account takeover.

An unauthenticated attacker can exploit this vulnerability to forge SAML assertions for any WordPress account, including administrators. Successful exploitation results in full authentication bypass, granting the attacker valid WordPress authentication cookies and complete control over the targeted account. This compromises confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, users should consider disabling the SAML Single Sign On – SSO Login plugin or restricting its use to trusted environments. Monitor vendor communications for updates and apply official patches promptly once available.