Nxploited/CVE-2026-15981

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python-based exploit for CVE-2026-15981 that performs unauthenticated authentication bypass against WordPress sites running the miniOrange SAML SSO plugin (<= 5.4.4). It forges a SAMLResponse with a malformed signature to trigger an openssl_verify() error, which is mishandled as a successful verification, leading to admin session creation. The tool includes user enumeration, SAML endpoint discovery, and post-exploitation shell upload capabilities.

Backdoor review

No backdoor observed in reviewed code

The PoC is a Python script that exploits CVE-2026-15981, an authentication bypass in the miniOrange SAML SSO WordPress plugin. It forges SAML responses with malformed signatures to gain an admin session and then deploys a webshell. All behavior is consistent with the disclosed exploit: the script targets the operator-supplied list of hosts, performs the described SAML bypass, verifies admin access, and uploads a webshell to the compromised target. No concealed, unrelated, or operator-targeting backdoor behavior is present.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwareWordPressminiOrange SAML 2.0 Single Sign On – SSO Login
Attack typesauthentication bypassremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a fully functional exploit that actively forges and delivers a malicious SAMLResponse to bypass authentication and gain administrative access, then deploys a web shell for remote code execution. The README explicitly labels it a 'Proof-of-Concept Exploit' and the code contains the complete exploitation pipeline.

README.md:18CVE-2026-15981.py:765-868

Requirements

  • Target must be running WordPress with the miniOrange SAML SSO plugin version <= 5.4.4.CVE-2026-15981.py:30CVE-2026-15981.py:316-318
  • Python 3.8+ with 'requests' and 'lxml' libraries installed.README.md:110-116

Observed behavior

  • Enumerates WordPress users via REST API, author archives, and HTML patterns.CVE-2026-15981.py:193-260
  • Discovers SAML Service Provider metadata (entityID, ACS URL) and IdP issuer URLs.CVE-2026-15981.py:263-377
  • Constructs a SAML Assertion with an attacker-controlled NameID and a malformed signature value (e.g., 0xFF*256, ASN.1 junk) designed to cause openssl_verify() to return -1.CVE-2026-15981.py:380-488CVE-2026-15981.py:84-95
  • Sends the forged SAMLResponse via HTTP POST to the ACS URL and checks for a WordPress authenticated session cookie.CVE-2026-15981.py:803-811
  • Verifies admin access by checking /wp-admin/ and confirms role via users.php/plugins.php.CVE-2026-15981.py:491-517
  • Uploads a PHP web shell (Nx.php) using one of four methods: plugin ZIP upload, REST API, theme/plugin editor, or media upload.CVE-2026-15981.py:542-696
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Webshell
Nx.phpA PHP webshell is uploaded to the compromised WordPress target as part of the disclosed post-exploitation phase.CVE-2026-15981.py:33CVE-2026-15981.py:44-62
Exploit Behavior
SAMLResponse forgery and admin session hijackingThe script crafts malicious SAML responses to bypass authentication on the target WordPress site, which is the core of the disclosed CVE-2026-15981 exploit.CVE-2026-15981.py:421-488CVE-2026-15981.py:777-832
Target Scope
Operator-supplied target listThe script operates exclusively on targets provided by the operator via a text file, with no hardcoded or concealed external destinations for data exfiltration.CVE-2026-15981.py:871-879CVE-2026-15981.py:888
Review boundaries

What the analysis did not establish

  • One file (unclassified, 1505 bytes) was omitted from analysis due to binary policy; it is not a text file and its content is unknown.
  • The evidence does not include the actual execution or verification of the exploit against a live target.
  • One file (unclassified, 1505 bytes) was not provided as text and was not analyzed, but its metadata suggests it is not executable code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1