CVE-2026-15981 is an authentication bypass vulnerability in the cyberlord92 SAML Single Sign On – SSO Login WordPress plugin. The vulnerability arises from the mo_saml_validate_signature() function performing a loose boolean check on the tri-state integer returned by PHP's openssl_verify(). Specifically, an error return value of -1 is incorrectly evaluated as truthy, causing the plugin to treat a failed signature verification as successful. This flaw enables unauthenticated attackers to bypass authentication by submitting a malicious SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature that triggers an OpenSSL processing error. Successful exploitation results in the attacker being logged in as any existing WordPress user, including administrators, via wp_set_auth_cookie(). The vulnerability affects all versions up to and including 5.4.4. No official patch or remediation guidance is currently provided by the vendor.

This vulnerability allows unauthenticated attackers to bypass authentication controls and log in as any WordPress user, including administrators. This grants full control over the affected WordPress site, enabling attackers to perform any actions available to the compromised user, such as modifying content, installing plugins, or stealing sensitive information. The vulnerability has a CVSS 3.1 base score of 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the SAML Single Sign On – SSO Login plugin or restricting access to trusted users only. Monitoring for suspicious login activity may help detect exploitation attempts. Avoid relying on this plugin for authentication in high-risk environments until the vulnerability is addressed.