CVE-2026-12281: Shibboleth WordPress Auth Bypass Flaw

CVE-2026-12281 Overview

CVE-2026-12281 is an authentication bypass vulnerability [CWE-287] in the Shibboleth WordPress plugin before version 2.5.4. The plugin fails to fail-closed when its HTTP header identity mode is enabled without an anti-spoofing key. Any request carrying identity headers is treated as an authenticated session without verification. Unauthenticated attackers can forge identity headers to log in as arbitrary users. When automatic account creation and the default administrator role mapping are enabled, attackers can create and sign in as new administrators.

Critical Impact
Unauthenticated attackers can obtain administrator access to affected WordPress sites by injecting forged identity headers, achieving full site compromise.

Affected Products

Shibboleth WordPress plugin versions prior to 2.5.4
WordPress deployments using HTTP header attribute mode
Deployments without upstream stripping of untrusted client identity headers

Discovery Timeline

2026-07-15 - CVE-2026-12281 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-12281

Vulnerability Analysis

The Shibboleth WordPress plugin supports multiple identity assertion modes, including one that reads identity attributes from HTTP request headers. This mode is intended for deployments where an upstream reverse proxy or Shibboleth Service Provider populates trusted headers after authenticating the user. The plugin exposes an anti-spoofing key setting that requires clients to include a shared secret header alongside identity headers.

When the anti-spoofing key is empty or absent, the plugin does not fail closed. It processes any incoming identity headers as if they came from a trusted upstream authenticator. The plugin then maps the asserted identity to a WordPress user session. If automatic account provisioning is enabled and the default role is set to administrator, the plugin creates a new administrator account matching the attacker-supplied identity and establishes an authenticated session.

Root Cause

The root cause is missing input validation and an insecure default handling path in the header-based authentication flow. The plugin trusts request headers without cryptographic or configuration-level verification. This violates the principle of failing closed when a required security control (the spoof key) is unconfigured.

Attack Vector

Exploitation is remote and unauthenticated but requires a specific non-default configuration. The attacker must reach a deployment where HTTP header attribute mode is enabled, the spoof key is empty, automatic account creation is enabled, and the front-end infrastructure does not strip client-supplied identity headers before they reach WordPress. Under those conditions, the attacker sends an HTTP request with forged identity headers such as REMOTE_USER or mapped Shibboleth attribute headers. The plugin accepts the assertion and provisions or authenticates the attacker as an administrator.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-12281

Indicators of Compromise

Newly created WordPress administrator accounts with usernames matching Shibboleth attribute formats such as eppn or uid values
Web server logs showing external requests carrying identity headers like REMOTE_USER, HTTP_EPPN, or HTTP_SHIB_* from untrusted source IPs
Successful WordPress login events without corresponding upstream Shibboleth SP authentication records

Detection Strategies

Audit the Shibboleth plugin configuration for HTTP header attribute mode combined with an empty spoof key
Inspect access logs for direct client requests containing Shibboleth attribute headers that bypass the reverse proxy
Correlate WordPress user_register and wp_login events with upstream identity provider authentication logs to detect mismatches

Monitoring Recommendations

Alert on creation of any WordPress administrator account outside of change-managed provisioning workflows
Monitor web application firewall logs for inbound requests carrying identity assertion headers from non-proxy sources
Track plugin configuration changes in the WordPress wp_options table for shibboleth_* keys

How to Mitigate CVE-2026-12281

Immediate Actions Required

Upgrade the Shibboleth WordPress plugin to version 2.5.4 or later
Configure a strong, unique spoof key in the plugin settings if HTTP header attribute mode is required
Disable automatic account creation or change the default new-user role from administrator to a lower-privilege role
Configure the upstream reverse proxy to strip all client-supplied identity headers before forwarding requests to WordPress

Patch Information

Upgrade to Shibboleth WordPress plugin version 2.5.4 or later. The patched release enforces fail-closed behavior when the spoof key is not configured in header attribute mode. See the WPScan Vulnerability Report for the fixed version reference.

Workarounds

Switch the plugin identity mode away from HTTP header attribute mode to a server-integrated Shibboleth SP mode
Set the plugin default role for auto-created users to subscriber instead of administrator
Deploy a web application firewall rule that blocks inbound requests carrying Shibboleth identity headers from clients outside the trusted proxy chain

bash

# Example nginx configuration to strip untrusted identity headers before proxying to WordPress
location / {
    proxy_set_header REMOTE_USER "";
    proxy_set_header HTTP_EPPN "";
    proxy_set_header HTTP_SHIB_IDENTITY_PROVIDER "";
    proxy_set_header HTTP_SHIB_AUTHENTICATION_METHOD "";
    proxy_pass http://wordpress_backend;
}