CyberRota Analysis
AI-GeneratedThe Shibboleth WordPress plugin prior to version 2.5.4 is vulnerable due to improper handling of identity headers, allowing unauthenticated attackers to log in as administrators by exploiting forged headers. This could lead to unauthorized access and control over the WordPress site, particularly if automatic account creation is enabled and untrusted client headers are not filtered. WordPress administrators using this plugin should prioritize updating to the latest version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment where untrusted client headers reach the application, an unauthenticated attacker can log in with forged identity headers and, when automatic account creation and the default administrator role mapping are enabled, create and sign in as a new administrator. Exploitation requires the non-default HTTP header attribute mode, an empty or absent spoof key, automatic account creation enabled, and a deployment that does not strip untrusted client headers before they reach the application.