Is CVE-2026-15013 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15013 being exploited in the wild.

How severe is CVE-2026-15013?

Critical severity, with a CVSS score of 9.8, published 16 July 2026.

Which products and versions are affected?

miniOrange SAML Single Sign On – SSO Login Up to and including 5.4.3.

Is there a fix for CVE-2026-15013?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15013 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15013?

Check whether you run miniOrange SAML Single Sign On – SSO Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15013: miniOrange SAML Single Sign On authentication bypass via algorithm confusion

CVE-2026-15013 · Severity: critical · CVSS 9.8 · Published 2026-07-16

The SAML Single Sign On plugin for WordPress, which allows users to log into websites using external identity providers, contains a critical security flaw. This vulnerability allows an attacker to bypass the login process and gain full administrative access to the website without needing a password. This could lead to a complete site takeover, theft of sensitive user data, and disruption of business operations.

Technologies: miniOrange SAML Single Sign On – SSO Login. Vendors: miniOrange.

Quick answers

Is CVE-2026-15013 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15013 being exploited in the wild.
How severe is CVE-2026-15013?: Critical severity, with a CVSS score of 9.8, published 16 July 2026.
Which products and versions are affected?: miniOrange SAML Single Sign On – SSO Login Up to and including 5.4.3.
Is there a fix for CVE-2026-15013?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15013 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15013?: Check whether you run miniOrange SAML Single Sign On – SSO Login at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authentication bypass via SAML Signature Algorithm Confusion in the `Mo_SAML_Utilities::mo_saml_cast_key()` function. The plugin incorrectly trusts the `SignatureMethod` Algorithm attribute provided in the attacker-controlled `SAMLResponse` instead of using a locally configured, trusted algorithm. This allows an attacker to force the plugin to treat the Identity Provider's (IdP) RSA public key as an HMAC-SHA1 shared secret. By signing a forged SAML assertion with this public key using HMAC, an attacker can bypass signature verification and gain full administrative access to the WordPress site. The issue affects all versions up to and including 5.4.3.

Affected products

miniOrange (cyberlord92) SAML Single Sign On – SSO Login Up to and including 5.4.3

Timeline

2026-07-16: disclosed
2026-07-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.