CVE-2026-15013 is a critical vulnerability in the cyberlord92 SAML Single Sign On – SSO Login WordPress plugin (versions <=5.4.3). The issue arises because the plugin's Mo_SAML_Utilities::mo_saml_cast_key() function reads the SignatureMethod Algorithm attribute directly from the attacker-controlled SAMLResponse parameter instead of enforcing the locally configured algorithm. This allows an attacker to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate a forged signature against it. Consequently, unauthenticated attackers can forge SAML assertions for any WordPress account, including administrators, and obtain valid authentication cookies, resulting in full administrator-level account takeover.

An unauthenticated attacker can bypass authentication controls by exploiting the signature algorithm confusion, leading to complete compromise of any WordPress account, including administrative accounts. This results in full control over the affected WordPress site, with confidentiality, integrity, and availability severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the SAML Single Sign On – SSO Login plugin or restricting its use to trusted environments. Monitor vendor channels for updates and apply patches promptly once released.