CVE-2026-15981 is an authentication bypass vulnerability in the cyberlord92 SAML Single Sign On – SSO Login WordPress plugin (versions <=5.4.4). The vulnerability arises from the mo_saml_validate_signature() function performing a loose boolean check on the return value of PHP's openssl_verify(). Specifically, an error return value of -1 is incorrectly evaluated as truthy, causing the plugin to treat a failed signature verification as successful. This flaw enables unauthenticated attackers to bypass authentication by submitting a malicious SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature that triggers an OpenSSL processing error. Exploitation results in the plugin calling wp_set_auth_cookie() for the targeted user account, effectively logging the attacker in as that user, including administrator accounts.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any existing WordPress user, including administrators. This grants full control over the affected WordPress site, enabling actions such as content modification, user management, and potential site takeover. The vulnerability has a CVSS score of 9.8 (critical), reflecting its high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the SAML Single Sign On – SSO Login plugin or restricting its use to trusted environments. Monitor vendor channels for updates and apply patches promptly once available.