Loading vulnerability…
CVE-2026-15981 is an authentication bypass vulnerability in the SAML Single Sign On – SSO Login plugin for WordPress affecting all versions up to and including 5.4.4. The flaw is in the mo_saml_validate_signature() function, which performs a loose boolean check on the tri-state integer returned by PHP's openssl_verify(). Because openssl_verify() returns 1 for a valid signature, 0 for an invalid signature, and -1 for an internal OpenSSL processing error, the vulnerable code can incorrectly treat the error value -1 as truthy and therefore as a successful signature verification. An unauthenticated attacker can exploit this by submitting a crafted SAMLResponse containing an attacker-controlled NameID and a deliberately malformed signature value that triggers an OpenSSL error, bypassing SAML signature validation and causing WordPress authentication logic to establish a session for the targeted existing user account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small standalone exploit project with 3 files: a primary Python exploit script (CVE-2026-15981.py), a README describing the vulnerability and workflow, and a custom license. The exploit is not part of a common framework such as Metasploit or Nuclei. The Python script targets CVE-2026-15981 in the miniOrange WordPress SAML SSO plugin (versions <= 5.4.4). Its core capability is unauthenticated authentication bypass by crafting SAMLResponse messages with malformed XML signature values intended to make PHP openssl_verify() return -1, which the vulnerable plugin allegedly treats as a successful boolean result. The script appears designed for mass exploitation: it reads targets from a file, uses multithreading, fingerprints WordPress installations, checks plugin presence/version, discovers SAML metadata and login endpoints, enumerates candidate usernames, and iterates through combinations of issuers, algorithms, malformed signatures, and audience/entity-ID options. The repository includes explicit post-auth exploitation logic. Once a valid WordPress session is obtained, the script verifies admin access through wp-admin pages and then attempts several persistence/code-execution routes described in the README: plugin ZIP upload, REST plugin upload, editor-based file write, and media upload. The embedded PHP payload is a basic uploader webshell wrapped as a WordPress plugin, using directory name nxproof and shell filename Nx.php, with marker string "Nx-zD" for deployment verification. Notable code indicators include hardcoded output files (sms.txt and sms_debug.json), the target plugin path /wp-content/plugins/miniorange-saml-20-single-sign-on/, SAML-related constants and namespaces, malformed signature test cases, and username enumeration regexes/patterns. Overall, this is an operational exploit with both initial access and post-exploitation components, rather than a mere detector or README-only proof of concept.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical authentication bypass vulnerability in the miniOrange SAML 2.0 Single Sign-On plugin for WordPress caused by improper handling of openssl_verify() return values, allowing malformed signatures that trigger OpenSSL errors to be accepted as valid.
Authentication bypass flaw in the miniOrange SAML 2.0 Single Sign On WordPress plugin where an OpenSSL verification error (-1) is treated as success, allowing invalid or forged signatures to be accepted.
An authentication bypass vulnerability in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin caused by improper handling of malformed signatures, where a loose boolean check on openssl_verify() can treat an error as successful verification, enabling unauthenticated login as any existing WordPress user including administrators.
An authentication bypass vulnerability in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that allows malformed signatures to pass validation, enabling forged SAML responses when chained with the companion flaw.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.