CVE-2026-15981

This vulnerability lets an attacker fake the “proof” that they successfully logged in through your SSO setup. If your site is using this plugin and that SSO login feature is turned on, the attacker can trick the system into granting them an admin login—like forging a stamp that says “authorized” even though it isn’t. Once they’re in as an admin, they can change your site and access anything your admin account can reach.

This matters if you run WordPress and have the plugin “SAML Single Sign On – SSO Login” installed at version 5.4.4 or earlier, with the SSO login feature active. It does not require the attacker to be logged in first, and no one needs to click anything for the attack to work. Treat it as a real risk because it is remotely reachable in default configurations and attackers are reported as actively trying to exploit it.

This is RED because attackers are already reported attempting to exploit it for unauthorized administrative logins. There’s no fix version information available yet, so the practical risk is immediate: if your WordPress site has this plugin and SSO login enabled, an attacker can try to take over without any credentials.

1. Confirm exposure (fast):

   • In WordPress Admin, go to Plugins and identify “SAML Single Sign On – SSO Login”. Record the exact installed version.
   • Confirm whether the SSO login feature is active/enabled on your site (not just the plugin installed—SSO login must be enabled per findings).

2. If you are on 5.4.4 or earlier:

   • Mitigation now: disable the plugin and/or disable the SSO login feature until you can confirm a fixed state.
   • If disabling breaks business operations, place SSO login behind the safest available access path your hosting allows (and be ready to revert quickly). The key goal is to stop accepting attacker-controlled SAMLResponse logins.

3. Check for compromise (today):

   • In WordPress Users, look for new accounts created recently, especially any new administrators.
   • Review recent admin login history (where available) for logins that don’t match your team’s activity.
   • If you find any suspicious accounts or logins, assume compromise and follow your incident process (including password resets and re-verification of admin access).

4. Patch/replace planning:

   • The findings state that no fix/patch information is available. Ask the plugin vendor/support for an ETA and a specific upgrade path for CVE-2026-15981.
   • If no fixed version exists in the near term, replace the plugin or keep it disabled, restoring login functionality via a safer supported method.

5. After changes:

   • Continue monitoring login attempts and admin account changes until the plugin situation is fully resolved.
   • Re-check plugin version after any updates to ensure the vulnerable plugin is not re-enabled by accident.

Severity is critical in practice (authentication bypass leading to full account compromise). The weakness is CWE-287 (Improper Authentication). The mechanism is an authentication bypass in SAML handling: an unauthenticated attacker can submit a crafted SAMLResponse that causes the plugin’s signature validation to fail “silently” (rather than correctly rejecting the login) and the code path then grants an authenticated session for a chosen WordPress user (including administrators). Per findings, this is reachable remotely without authentication, requires no user interaction, and affects default configurations for SAML Single Sign On – SSO Login up through version 5.4.4. KEV has no listing, but exploitation is reported as YES with ongoing opportunistic attacks targeting WordPress admin access. No public exploit code is on record, but lack of code does not reduce urgency given reported exploitation and remote reachability. EPSS is present as a prediction, but it should not be treated as the driver for action here because exploitation reporting/press attention indicates active threat activity.