miniOrange 5.4.3 - Unauthenticated Auth Bypass

Exploit Title: miniOrange 5.4.3 - Unauthenticated Auth Bypass Google Dork: inurl:/wp-content/plugins/miniorange-saml-20-single-sign-on/ Date: 2026-07-27 Exploit Author: zer0dayf Vendor Homepage: https://plugins.wordpress.org/miniorange-saml-20-single-sign-on/ Software Link:...

CVE-2026-15013

creationtimestamp| type| source ---|---|--- 2026-07-16 06:00:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116928127100536568 2026-07-16 06:00:29+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mqqko4sy4f2z 2026-07-16 06:26:05+00:00| seen|...

CVE-2026-15013

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because MoSAMLUtilities::mosamlcastkey reads the SignatureMethod Algorithm attribute directl...