CVE-2026-15981: WordPress SAML SSO Authentication Bypass (CVSS 9.8)

A critical CVE-2026-15981 vulnerability (CVSS 9.8) in the SAML Single Sign On – SSO Login WordPress plugin (≤5.4.4) allows unauthenticated attackers to gain fully authenticated sessions — including administrator accounts — by submitting a SAMLResponse that triggers an OpenSSL verification error (openssl_verify() returning -1) which the plugin incorrectly treats as a valid signature. A sibling flaw (CVE-2026-15013) enables an algorithm-confusion attack (treating an RSA key as an HMAC secret), together resulting in a complete signature validation breakdown; immediate patching to versions >5.4.4 or disabling the plugin and applying access restrictions are recommended.